{"id":"CVE-2026-40895","aliases":["CLSA-2026-1777163888","CLSA-2026-1778805975","CLSA-2026-1782176274","CLSA-2026-1782262689","CLSA-2026-1782262690","CLSA-2026-1782262692","CLSA-2026-1782262693","CLSA-2026-1782262694","CLSA-2026-1787663318","CLSA-2026-1787664257","CLSA-2026-1792074325","DEBIAN-CVE-2026-40895","EUVD-2026-24472","GHSA-r4q5-vmmm-2653","ROOT-APP-NPM-GHSA-r4q5-vmmm-2653","UBUNTU-CVE-2026-40895","USN-8632-1"],"status":"published","title":"follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00486,"percentile":0.42331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212"],"published":"2026-04-14T01:11:11Z","modified":"2026-11-04T02:47:34Z","fixes":[{"ecosystem":"npm","package":"follow-redirects","fixed_in":["1.16.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"follow-redirects","fixed_in":["1.15.11-tuxcare.2","0.0.3-tuxcare.2","1.15.9-tuxcare.1","1.15.6-tuxcare.1","0.0.3-tuxcare.3","1.5.10-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-follow-redirects","fixed_in":["1.16.0+~1.14.4-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/follow-redirects","fixed_in":["1.15.11-root.io.1","1.15.6-root.io.1","1.15.11-root.io.2","1.15.6-root.io.2","1.15.9-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"follow-redirects","fixed_in":["1.15.11-aikido.2","1.15.6-aikido.2","1.15.9-aikido.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.18.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.20.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","fixed_in":["1.14.9+~1.14.1-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-follow-redirects","fixed_in":["1.15.6+~1.14.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-follow-redirects","fixed_in":["1.15.11+~1.14.4-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.11"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.11-tuxcare.0"},{"fixed":"1.15.11-tuxcare.2"}]}],"versions":["1.15.11","1.15.11-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.3-tuxcare.0"},{"fixed":"0.0.3-tuxcare.2"}]}],"versions":["0.0.3","0.0.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.1"}]}],"versions":["1.5.10"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.9-tuxcare.0"},{"fixed":"1.15.9-tuxcare.1"}]}],"versions":["1.15.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.5-tuxcare.0"},{"fixed":"1.15.5-tuxcare.1"}]}],"versions":["1.15.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.3-tuxcare.0"},{"fixed":"1.15.3-tuxcare.1"}]}],"versions":["1.15.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.2-tuxcare.0"},{"fixed":"1.15.2-tuxcare.1"}]}],"versions":["1.15.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.6-tuxcare.0"},{"fixed":"1.15.6-tuxcare.1"}]}],"versions":["1.15.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.3-tuxcare.0"},{"fixed":"0.0.3-tuxcare.3"}]}],"versions":["0.0.3","0.0.3-tuxcare.1","0.0.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.2"}]}],"versions":["1.5.10","1.5.10-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.6-tuxcare.0"},{"fixed":"1.2.6-tuxcare.2"}]}],"versions":["1.2.6","1.2.6-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.11+~1.14.4-1","1.15.11+~1.14.4-2","1.15.2+~1.14.1-1","1.15.3+~1.14.2-1","1.15.6+~1.14.4-1","1.15.6+~1.14.4-2","1.15.9+~1.14.4-1","1.16.0+~1.14.4-1","1.16.0+~1.14.4-2","1.16.1+~1.14.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.11+~1.14.4-1","1.15.11+~1.14.4-2","1.15.9+~1.14.4-1","1.16.0+~1.14.4-1","1.16.0+~1.14.4-2","1.16.1+~1.14.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0+~1.14.4-1"}]}],"versions":["1.15.11+~1.14.4-1","1.15.11+~1.14.4-2","1.15.9+~1.14.4-1"]},{"source":"osv","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.11-root.io.1"},{"fixed":"1.15.6-root.io.1"},{"fixed":"1.15.11-root.io.2"},{"fixed":"1.15.6-root.io.2"},{"fixed":"1.15.9-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.11-aikido.2"},{"fixed":"1.15.6-aikido.2"},{"fixed":"1.15.9-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm2"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm2"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm2"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1","1.14.9+~1.14.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1ubuntu0.1~esm1"}]}],"versions":["1.15.2+~1.14.1-1","1.15.3+~1.14.2-1","1.15.6+~1.14.4-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.9+~1.14.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.11+~1.14.4-1ubuntu0.1~esm1"}]}],"versions":["1.15.9+~1.14.4-1","1.15.11+~1.14.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm2"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm2"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm2"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1","1.14.9+~1.14.1-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1ubuntu0.1~esm1"}]}],"versions":["1.15.2+~1.14.1-1","1.15.3+~1.14.2-1","1.15.6+~1.14.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.11+~1.14.4-1ubuntu0.1~esm1"}]}],"versions":["1.15.9+~1.14.4-1","1.15.11+~1.14.4-1build1"]}],"products":[{"vendor":"follow-redirects","product":"follow-redirects"},{"vendor":"follow-redirects_project","product":"follow-redirects"},{"vendor":"red hat","product":"cluster observability operator 1.5.0"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"cryostat 4 on rhel 9"},{"vendor":"red hat","product":"gatekeeper 3"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"migration toolkit for virtualization"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.1"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.11"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"},{"vendor":"red hat","product":"network observability (netobserv) 1.11.0"},{"vendor":"red hat","product":"node healthcheck operator"},{"vendor":"red hat","product":"openshift lightspeed"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"},{"vendor":"red hat","product":"red hat advanced cluster security for kubernetes 4.10"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat connectivity link 1"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat edge manager 1"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat migration toolkit for applications 8.1"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.17"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.28"},{"vendor":"red hat","product":"red hat openshift distributed tracing 3"},{"vendor":"red hat","product":"red hat openshift gitops"},{"vendor":"red hat","product":"red hat openshift service mesh 2.6"},{"vendor":"red hat","product":"red hat openshift service mesh 3.0"},{"vendor":"red hat","product":"red hat openshift service mesh 3.1"},{"vendor":"red hat","product":"red hat openshift service mesh 3.2"},{"vendor":"red hat","product":"red hat openshift service mesh 3.3"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.14"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.17"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted artifact signer"},{"vendor":"red hat","product":"red hat trusted profile analyzer"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40895","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460297","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40895.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17789","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26010","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16874","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24539","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25273","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24766","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21338","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14937","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47728","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48699","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44235","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27004","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44263","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27063","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44267","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27044","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40768","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16476","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16534","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16532","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16535","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16542","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22840","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22629","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21017","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22465","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23361","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25271","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24536","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17657","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17699","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:19109","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9","tags":["fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40895","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r4q5-vmmm-2653"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40895.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40895","tags":["advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-40895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40895","tags":["report"]},{"url":"https://github.com/follow-redirects/follow-redirects/pull/284","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8632-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40895","title":"follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T19:59:59.759Z","modified":"2026-09-10T12:05:07.783Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-24472","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T19:59:59Z","modified":"2026-11-02T23:19:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T05:08:36.239358Z"}],"ghsa":[{"id":"GHSA-r4q5-vmmm-2653","title":"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets","description":"## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n## Affected Code\n\n`index.js`, lines 469-476:\n\n```javascript\nif (redirectUrl.protocol !== currentUrlParts.protocol \u0026\u0026\n   redirectUrl.protocol !== \"https:\" ||\n   redirectUrl.host !== currentHost \u0026\u0026\n   !isSubdomain(redirectUrl.host, currentHost)) {\n  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);\n}\n```\n\nThe regex only matches `authorization`, `proxy-authorization`, and `cookie`. Custom headers like `X-API-Key` are not matched.\n\n## Attack Scenario\n\n1. App uses axios with custom auth header: `headers: { 'X-API-Key': 'sk-live-secret123' }`\n2. Server returns `302 Location: https://evil.com/steal`\n3. follow-redirects sends `X-API-Key: sk-live-secret123` to `evil.com`\n4. Attacker captures the API key\n\n## Impact\n\nAny custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.\n\n## Suggested Fix\n\nAdd a `sensitiveHeaders` option that users can extend, or strip ALL non-standard headers on cross-domain redirect.\n\n## Disclosure\n\nSource code review, manually verified. Found 2026-03-20.","status":"published","published":"2026-04-14T01:11:11Z","modified":"2026-11-02T23:19:21Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-03T00:02:45.112873Z"}],"nvd":[{"id":"CVE-2026-40895","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T21:16:44.337Z","modified":"2026-11-11T23:10:00.263Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-12T01:26:58.520432Z"}],"osv":[{"id":"CVE-2026-40895","title":"follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T19:59:59.759Z","modified":"2026-11-04T02:47:34.649506182Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-04T02:53:45.692342Z"},{"id":"DEBIAN-CVE-2026-40895","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T21:16:44.337Z","modified":"2026-11-03T10:00:22.494115176Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"GHSA-r4q5-vmmm-2653","title":"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets","description":"## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n## Affected Code\n\n`index.js`, lines 469-476:\n\n```javascript\nif (redirectUrl.protocol !== currentUrlParts.protocol \u0026\u0026\n   redirectUrl.protocol !== \"https:\" ||\n   redirectUrl.host !== currentHost \u0026\u0026\n   !isSubdomain(redirectUrl.host, currentHost)) {\n  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);\n}\n```\n\nThe regex only matches `authorization`, `proxy-authorization`, and `cookie`. Custom headers like `X-API-Key` are not matched.\n\n## Attack Scenario\n\n1. App uses axios with custom auth header: `headers: { 'X-API-Key': 'sk-live-secret123' }`\n2. Server returns `302 Location: https://evil.com/steal`\n3. follow-redirects sends `X-API-Key: sk-live-secret123` to `evil.com`\n4. Attacker captures the API key\n\n## Impact\n\nAny custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.\n\n## Suggested Fix\n\nAdd a `sensitiveHeaders` option that users can extend, or strip ALL non-standard headers on cross-domain redirect.\n\n## Disclosure\n\nSource code review, manually verified. Found 2026-03-20.","status":"published","published":"2026-04-14T01:11:11Z","modified":"2026-11-02T23:30:04.262099247Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-03T00:02:56.706843Z"},{"id":"UBUNTU-CVE-2026-40895","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.","status":"published","published":"2026-04-21T21:16:00Z","modified":"2026-08-13T07:45:11.89845186Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"CLSA-2026-1777163888","title":"TuxCare security update for follow-redirects (2 CVEs)","description":"TuxCare rebuilt follow-redirects to address 2 CVEs. Fixed in 1.15.11-tuxcare.2.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:45:49.585410083Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778805975","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 0.0.3-tuxcare.2.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:28.658710387Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1782176274","title":"TuxCare security update for follow-redirects (5 CVEs)","description":"TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.323495469Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262689","title":"TuxCare security update for follow-redirects (2 CVEs)","description":"TuxCare rebuilt follow-redirects to address 2 CVEs. Fixed in 1.15.9-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.680751887Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262690","title":"TuxCare security update for follow-redirects (3 CVEs)","description":"TuxCare rebuilt follow-redirects to address 3 CVEs. Fixed in 1.15.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:10.025277439Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262692","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993398018Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262693","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993368244Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262694","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.15.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:10.488773303Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787663318","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 0.0.3-tuxcare.3.","status":"published","published":"2026-08-25T13:08:38Z","modified":"2026-10-15T09:48:03.171070427Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787664257","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.5.10-tuxcare.2.","status":"published","published":"2026-08-25T13:24:17Z","modified":"2026-10-15T09:48:03.137381664Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792074325","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.","status":"published","published":"2026-10-15T14:25:25Z","modified":"2026-10-15T19:00:11.997374602Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"ROOT-APP-NPM-GHSA-r4q5-vmmm-2653","title":"GHSA-r4q5-vmmm-2653 in @rootio/follow-redirects - Patched by Root","description":"Root has patched GHSA-r4q5-vmmm-2653 in the @rootio/follow-redirects package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-26T12:32:42Z","modified":"2026-06-26T19:15:03.963513074Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"USN-8632-1","title":"node-follow-redirects vulnerability","description":"Dennis Sepede discovered that follow-redirects did not properly remove\ncustom authentication headers when following cross-domain redirects. An\nattacker could possibly use this issue to obtain sensitive authentication\ninformation, resulting in credential disclosure.","status":"published","published":"2026-08-12T20:27:13Z","modified":"2026-08-13T07:58:49.938263414Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}