CVE-2026-40895 — follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Affected: follow-redirects, Red Hat Cryostat 4 on RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.6, Red Hat multicluster engine for Kubernetes 2.8, Red Hat multicluster engine for Kubernetes 2.9, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Advanced Cluster Management for Kubernetes 2.14 and 72 more

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

USN-8632-1 — node-follow-redirects vulnerability

Affected: Ubuntu:Pro:18.04:LTS: node-follow-redirects, Ubuntu:Pro:20.04:LTS: node-follow-redirects, Ubuntu:Pro:22.04:LTS: node-follow-redirects, Ubuntu:Pro:24.04:LTS: node-follow-redirects, Ubuntu:Pro:26.04:LTS: node-follow-redirects

Dennis Sepede discovered that follow-redirects did not properly remove custom authentication headers when following cross-domain redirects. An attacker could possibly use this issue to obtain sensitive authentication information, resulting in credential disclosure.

Most recent entries from all

CVE-2026-40895 — follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

USN-8632-1 — node-follow-redirects vulnerability