p PatchFirst

CVE-2026-40895

CVE-2026-40895 · follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

CVSS 6.9 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • follow-redirects

    Versions
    • < 1.16.0: Affected

    No fix published

  • node-follow-redirects Debian:12

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    • 1.15.6+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Debian:13

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Debian:14

    Versions
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.9+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: < 1.16.0+~1.14.4-1

    Update to 1.16.0+~1.14.4-1

  • follow-redirects npm

    Affected ranges
    • SEMVER: < 1.16.0

    Update to 1.16.0

  • node-follow-redirects Ubuntu:Pro:18.04:LTS

    Versions
    • 1.2.4-1
    • 1.2.4-1ubuntu0.18.04.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.2.4-1ubuntu0.18.04.1~esm2

    Update to 1.2.4-1ubuntu0.18.04.1~esm2

  • node-follow-redirects Ubuntu:Pro:20.04:LTS

    Versions
    • 1.2.4-1
    • 1.2.4-1ubuntu0.20.04.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.2.4-1ubuntu0.20.04.1~esm2

    Update to 1.2.4-1ubuntu0.20.04.1~esm2

  • node-follow-redirects Ubuntu:Pro:22.04:LTS

    Versions
    • 1.13.1-1
    • 1.14.5-1
    • 1.14.7+~1.13.1-1
    • 1.14.8+~1.14.0-1
    • 1.14.9+~1.14.1-1
    • 1.14.9+~1.14.1-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 1.14.9+~1.14.1-1ubuntu0.1~esm2

    Update to 1.14.9+~1.14.1-1ubuntu0.1~esm2

  • node-follow-redirects Ubuntu:Pro:24.04:LTS

    Versions
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: < 1.15.6+~1.14.4-1ubuntu0.1~esm1

    Update to 1.15.6+~1.14.4-1ubuntu0.1~esm1

  • node-follow-redirects Ubuntu:25.10

    Versions
    • 1.15.9+~1.14.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-follow-redirects Ubuntu:Pro:26.04:LTS

    Versions
    • 1.15.9+~1.14.4-1
    • 1.15.11+~1.14.4-1build1
    Affected ranges
    • ECOSYSTEM: < 1.15.11+~1.14.4-1ubuntu0.1~esm1

    Update to 1.15.11+~1.14.4-1ubuntu0.1~esm1

Original sources

Check your server →