# CVE-2026-40895: follow-redirects sensitive header leak in cross-domain redirects

Source: https://junglewise.ai/threats/cve-2026-40895-follow-redirects-sensitive-header-leak-in-cross-domain-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-40895 · Severity: high · CVSS 7.5 · Published 2026-04-21

A security flaw in the 'follow-redirects' library, a widely used component for handling web requests in Node.js applications (including the popular 'axios' library), can lead to the exposure of sensitive credentials. When a web request is redirected to a different domain, the library fails to remove custom security headers like API keys or authentication tokens. This allows a malicious website to capture these secrets if a user's application is tricked into following a redirect to an attacker-controlled server.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios), [follow-redirects (npm)](https://junglewise.ai/threats/technologies/follow-redirects), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios), [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-40895 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40895 being exploited in the wild.

**How severe is CVE-2026-40895?** High severity, with a CVSS score of 7.5, published 21 April 2026.

**Which products and versions are affected?** Kiali 2.6; follow-redirects (npm) SEMVER:introduced=0,fixed=1.16.0; Red Hat Developer Hub < 1.9.4.

**Is there a fix for CVE-2026-40895?** Yes. follow-redirects (npm): upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40895 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40895?** Check whether you run Axios, Kiali, follow-redirects (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- follow-redirects (npm): upgrade to 1.16.0 or later

  ```sh
  npm install follow-redirects@1.16.0
  ```


## Technical details

The follow-redirects library (prior to version 1.16.0) contains an information disclosure vulnerability where custom HTTP authentication headers are forwarded to cross-domain redirect targets. While the library's logic at index.js correctly strips standard 'Authorization', 'Proxy-Authorization', and 'Cookie' headers using a regex, it does not account for custom headers such as 'X-API-Key' or 'Token'. An attacker can exploit this by inducing a request to a malicious URL that returns a 3xx redirect status code; the library will then forward the original request's custom sensitive headers to the new, potentially malicious, domain. This is particularly impactful as follow-redirects is a core dependency of the axios ecosystem. The issue is resolved in version 1.16.0 by improving header stripping logic.

## Affected products

- follow-redirects follow-redirects < 1.16.0
- axios axios
- Red Hat Red Hat Developer Hub < 1.9.4
- Red Hat Red Hat Discovery
- Red Hat Red Hat OpenShift Service Mesh (Kiali) 2.6

## Identifiers

- CVE-2026-40895
- GHSA-r4q5-vmmm-2653

## Timeline

- 2026-03-20: disclosed: Vulnerability found via source code review and verified.
- 2026-04-13: advisory: GitHub Security Advisory published.
- 2026-04-21: patched: NVD publication and fix availability in version 1.16.0.
- 2026-05-05: patched: Red Hat released fixes for Developer Hub.

## References

- [https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653](https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653)
- [https://access.redhat.com/errata/RHSA-2026:13826](https://access.redhat.com/errata/RHSA-2026:13826)
- [https://access.redhat.com/errata/RHSA-2026:14937](https://access.redhat.com/errata/RHSA-2026:14937)
- [https://access.redhat.com/errata/RHSA-2026:16476](https://access.redhat.com/errata/RHSA-2026:16476)
- [https://access.redhat.com/errata/RHSA-2026:16532](https://access.redhat.com/errata/RHSA-2026:16532)
- [https://access.redhat.com/errata/RHSA-2026:16534](https://access.redhat.com/errata/RHSA-2026:16534)
- [https://access.redhat.com/errata/RHSA-2026:16535](https://access.redhat.com/errata/RHSA-2026:16535)

## Related threats

- [follow-redirects credential header leakage on cross-origin redirect](https://junglewise.ai/threats/cve-2026-116689-follow-redirects-is-a-node-js-http-and-https-client-wrapper-that)
- [follow-redirects credential header disclosure with array-form headers](https://junglewise.ai/threats/cve-2026-111756-follow-redirects-array-form-headers-bypass-cross-origin)
- [follow-redirects regex escape bypass in credential filtering](https://junglewise.ai/threats/cve-2026-111755-follow-redirects-is-a-node-js-http-and-https-client-wrapper-that)
- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)