VULNERABILITY INTELLIGENCE

CVE-2026-40895

CVSS score7.5 HIGH
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-04-21
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Weakness classification

  • security-advisories@github.com: CWE-200
  • nvd@nist.gov: NVD-CWE-noinfo
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-212

Primary references