CVE-2026-40895: follow-redirects sensitive header leak in cross-domain redirects

CVE-2026-40895 · Severity: high · CVSS 7.5 · Published 2026-04-21

A security flaw in the 'follow-redirects' library, a widely used component for handling web requests in Node.js applications (including the popular 'axios' library), can lead to the exposure of sensitive credentials. When a web request is redirected to a different domain, the library fails to remove custom security headers like API keys or authentication tokens. This allows a malicious website to capture these secrets if a user's application is tricked into following a redirect to an attacker-controlled server.

Technologies: Axios, follow-redirects (npm), Red Hat Developer Hub. Vendors: Axios, npm, Red Hat.

Quick answers

Is CVE-2026-40895 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40895 being exploited in the wild.
How severe is CVE-2026-40895?
High severity, with a CVSS score of 7.5, published 21 April 2026.
Which products and versions are affected?
Kiali 2.6; follow-redirects (npm) SEMVER:introduced=0,fixed=1.16.0; Red Hat Developer Hub < 1.9.4.
Is there a fix for CVE-2026-40895?
Yes. follow-redirects (npm): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40895 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40895?
Check whether you run Axios, Kiali, follow-redirects (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • follow-redirects (npm): upgrade to 1.16.0 or later
    npm install follow-redirects@1.16.0

Technical details

The follow-redirects library (prior to version 1.16.0) contains an information disclosure vulnerability where custom HTTP authentication headers are forwarded to cross-domain redirect targets. While the library's logic at index.js correctly strips standard 'Authorization', 'Proxy-Authorization', and 'Cookie' headers using a regex, it does not account for custom headers such as 'X-API-Key' or 'Token'. An attacker can exploit this by inducing a request to a malicious URL that returns a 3xx redirect status code; the library will then forward the original request's custom sensitive headers to the new, potentially malicious, domain. This is particularly impactful as follow-redirects is a core dependency of the axios ecosystem. The issue is resolved in version 1.16.0 by improving header stripping logic.

Affected products

  • follow-redirects follow-redirects < 1.16.0
  • axios axios
  • Red Hat Red Hat Developer Hub < 1.9.4
  • Red Hat Red Hat Discovery
  • Red Hat Red Hat OpenShift Service Mesh (Kiali) 2.6

Identifiers

  • CVE-2026-40895
  • GHSA-r4q5-vmmm-2653

Timeline

  • 2026-03-20: disclosed: Vulnerability found via source code review and verified.
  • 2026-04-13: advisory: GitHub Security Advisory published.
  • 2026-04-21: patched: NVD publication and fix availability in version 1.16.0.
  • 2026-05-05: patched: Red Hat released fixes for Developer Hub.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.