CVE-2026-40895 follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Attackers can steal custom authentication headers from Node.js applications when they follow cross-domain redirects, exposing sensitive API keys or tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40895?
CVE-2026-40895 is a medium-severity vulnerability in follow-redirects, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Which versions are affected by CVE-2026-40895?
2 open source packages ship an affected version, including follow-redirects. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
follow-redirects npm | All versions | 1.16.0 |
follow-redirects npm | All versions | 1.16.0 |
Products include Follow-Redirects Project Follow-Redirects.
How do I fix CVE-2026-40895?
Upgrade follow-redirects to 1.16.0 or later.
Is CVE-2026-40895 being exploited?
There is no known exploitation of CVE-2026-40895 in the wild and no public exploit code.
Other vulnerabilities in follow-redirects
- CVE-2022-0155 Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
- CVE-2024-28849 Proxy-Authorization header kept across hosts in follow-redirects
- CVE-2022-0536 Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Sources
Also known as CLEANSTART-2026-NO27854, CLSA-2026-1777163888, CLSA-2026-1778805975, CLSA-2026-1782262689, CLSA-2026-1782262694, CLSA-2026-1787663318 and 32 more.