Cross-Domain Redirect Vulnerability in Follow-Redirects for Node.js

CVE-2026-40895

What is CVE-2026-40895?

The Follow-Redirects library, designed to simplify HTTP requests in Node.js by automatically navigating redirects, has a flaw that impacts security. Specifically, in versions prior to 1.16.0, the library fails to adequately handle custom authentication headers during cross-domain redirects. While it strips standard authorization, proxy-authorization, and cookie headers, any custom headers, such as X-API-Key or X-Auth-Token, are sent unaltered to the redirect target. This oversight exposes users to potential unauthorized access as sensitive information may be inadvertently leaked to untrusted sites. Updating to version 1.16.0 addresses this critical issue.

References