CVE-2026-40895 — follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Affected: follow-redirects, Red Hat Cryostat 4 on RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.6, Red Hat multicluster engine for Kubernetes 2.8, Red Hat multicluster engine for Kubernetes 2.9, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Advanced Cluster Management for Kubernetes 2.14 and 72 more

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Most recent entries from all

CVE-2026-40895 — follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets