CVE-2026-40895
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
In the follow-redirects library for Node.js, a vulnerability was found where custom authentication headers (e.g., X-API-Key, X-Auth-Token) are not stripped during cross-domain redirects. An attacker could exploit this to intercept sensitive credentials.
Risk Assessment
The organization risks leaking API keys and authorization tokens to external, potentially malicious servers when handling HTTP redirects.
Recommendation
Immediately update the follow-redirects library to version 1.16.0 or later, which fixes this vulnerability.
Other vulnerabilities in follow-redirects
See all- CVE-2026-116689Medium
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.
- CVE-2026-111756High
A vulnerability in follow-redirects (versions 1.16.0 to before 1.16.1) causes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, sensitiveHeaders) not to be stripped when following a cross-host or protocol-downgrade redirect if the application supplied headers as an alternating array of names and values. The removal routine uses for...in, which yields numeric indices for arrays, so no header name matches the filter and nothing is removed. As a result, the application forwards credentials to an attacker-controlled destination without any error or warning.
- CVE-2026-111755High
follow-redirects versions 1.16.0 through 1.16.1 fail to escape regex metacharacters (^ or |) in sensitive header names. As a result, on cross-origin or HTTPS-to-HTTP redirects, the generated filter does not match the declared header and the credential header is forwarded to an attacker-controlled redirect target. The issue is fixed in version 1.16.1.
Original NVD description (English source)
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS