CVE-2026-40895 Details
Description
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
A vulnerability exists in follow-redirects, a Node.js library that automatically follows HTTP redirects. In versions prior to 1.16.0, the library fails to properly handle custom authentication headers when following cross-domain redirects. Instead of stripping these headers, follow-redirects forwards them verbatim to the redirect target. This issue is particularly concerning because follow-redirects is used as the default redirect handler in axios, a popular HTTP client for Node.js.
Users can update to follow-redirects version 1.16.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | redhat-SADP |
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| follow-redirects project follow-redirects | < 1.16.0 |
CPE
Remediation
| |
Change History
37 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Aug 31, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 26, 2026 | CVE Modified | redhat-SADP |
| Aug 25, 2026 | CVE Modified | redhat-SADP |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 18, 2026 | CVE Modified | redhat-SADP |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 14, 2026 | CVE Modified | redhat-SADP |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 10, 2026 | CVE Modified | redhat-SADP |
| Aug 6, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Aug 4, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 31, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 29, 2026 | CVE Modified | redhat-SADP |
| Jul 28, 2026 | CVE Modified | redhat-SADP |
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |