---
id: "CVE-2026-40895"
kind: "vulnerability"
aliases: ["CVE-2026-40895", "GHSA-r4q5-vmmm-2653"]
title: "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets"
severity: "high"
cvss: 7.5
epss: 0.00486
exploited: false
status: "open"
category: "package"
products: [{"name": "follow-redirects", "fixed": ["1.16.0"], "affected": "<= 1.15.11", "ecosystem": "npm"}, {"name": "follow-redirects project follow-redirects", "fixed": ["1.16.0"], "affected": "< 1.16.0", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["axios", "cwe-200", "follow-redirects", "node.js", "npm", "package"]
not_affected_if: ["no-custom-auth-headers", "same-origin-requests-only"]
published_at: "2026-04-14T01:11:11+00:00"
first_seen_at: "2026-11-02T23:19:56+00:00"
updated_at: "2026-11-02T23:35:57+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-r4q5-vmmm-2653", "first_seen_at": "2026-11-02T23:19:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40895", "first_seen_at": "2026-11-02T23:35:57+00:00"}]
---

# follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

follow-redirects strips only authorization, proxy-authorization and cookie headers when a request follows a cross-domain redirect. Custom authentication headers such as X-API-Key are sent unchanged to the redirect target, so that server can capture them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:follow-redirects affected <= 1.15.11 fixed 1.16.0
- vendor:follow-redirects project follow-redirects affected < 1.16.0 fixed 1.16.0

## How to check

- Find the installed version with `npm ls follow-redirects` and check whether it is `1.15.11` or older.
- Check whether axios or another HTTP client sends API keys or tokens in custom headers (for example `X-API-Key`) and whether those requests can be redirected to other hosts.

## Fix

- follow-redirects: move to `1.16.0`.

## Timeline

- 2026-11-02T23:19:56+00:00 ghsa https://github.com/advisories/GHSA-r4q5-vmmm-2653
- 2026-11-02T23:35:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-40895

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/follow-redirects/follow-redirects/security-advisories/GHSA-r4q5-vmmm-2653
- [advisory] Maintainer's advisory: github.com https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
- [fix] Patch: github.com https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9

## From the sources

## Summary

When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.

Since `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.

## Affected Code

`index.js`, lines 469-476:

```javascript
if (redirectUrl.protocol !== currentUrlParts.protocol &&
   redirectUrl.protocol !== "https:" ||
   redirectUrl.host !== currentHost &&
   !isSubdomain(redirectUrl.host, currentHost)) {
  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
}
```

The regex only matches `authorization`, `proxy-authorization`, and `cookie`. Custom headers like `X-API-Key` are not matched.

## Attack Scenario

1. App uses axios with custom auth header: `headers: { 'X-API-Key': 'sk-live-secret123' }`
2. Server returns `302 Location: https://evil.com/steal`
3. follow-redirects sends `X-API-Key: sk-live-secret123` to `evil.com`
4. Attacker captures the API key

## Impact

Any custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.

## Suggested Fix

Add a `sensitiveHeaders` option that users can extend, or strip ALL non-standard headers on cross-domain redirect.

## Disclosure

Source code review, manually verified. Found 2026-03-20.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_