CVE-2026-40895
follow-redirects is an open source, drop-in replacement for Node's and modules that automatically follows redirects.
Published Apr 21, 2026 · updated Sep 10, 2026 · follow-redirects project follow-redirects
follow-redirects is an open source, drop-in replacement for Node's and modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
follow-redirects is an open source, drop-in replacement for Node's and modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Toke
Sep 10, 2026 · NIST NVD
Updated
follow-redirects is an open source, drop-in replacement for Node's and modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Toke
Affected
- cpe follow-redirects project/follow-redirectsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40895
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40895
follow-redirects is an open source, drop-in replacement for Node's and modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authoriza
nvd.nist.gov