Junglewise Threat Intelligence

CVE-2026-40895: follow-redirects sensitive header leak in cross-domain redirects

CVE-2026-40895 · Severity: high · CVSS 7.5 · Published 2026-04-21

Technologies: Axios, Follow-Redirects, Red Hat Developer Hub. Vendors: Axios, Red Hat, npm.

Executive brief

A security flaw in the 'follow-redirects' library, a widely used component for handling web requests in Node.js applications (including the popular 'axios' library), can lead to the exposure of sensitive credentials. When a web request is redirected to a different domain, the library fails to remove custom security headers like API keys or authentication tokens. This allows a malicious website to capture these secrets if a user's application is tricked into following a redirect to an attacker-controlled server.

Technical details

The follow-redirects library (prior to version 1.16.0) contains an information disclosure vulnerability where custom HTTP authentication headers are forwarded to cross-domain redirect targets. While the library's logic at index.js correctly strips standard 'Authorization', 'Proxy-Authorization', and 'Cookie' headers using a regex, it does not account for custom headers such as 'X-API-Key' or 'Token'. An attacker can exploit this by inducing a request to a malicious URL that returns a 3xx redirect status code; the library will then forward the original request's custom sensitive headers to the new, potentially malicious, domain. This is particularly impactful as follow-redirects is a core dependency of the axios ecosystem. The issue is resolved in version 1.16.0 by improving header stripping logic.

Affected products

  • follow-redirects follow-redirects < 1.16.0
  • axios axios
  • Red Hat Red Hat Developer Hub < 1.9.4
  • Red Hat Red Hat Discovery
  • Red Hat Red Hat OpenShift Service Mesh (Kiali) 2.6

Timeline

  • 2026-03-20: disclosed: Vulnerability found via source code review and verified.
  • 2026-04-13: advisory: GitHub Security Advisory published.
  • 2026-04-21: patched: NVD publication and fix availability in version 1.16.0.
  • 2026-05-05: patched: Red Hat released fixes for Developer Hub.

References

Related threats