CVE-2026-40895mediumCWE-200CWE-212

CVE-2026-40895: falha de média gravidade em follow-redirects

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar follow-redirects+ Monitorar node-follow-redirects

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.5%
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
follow-redirects · follow-redirects
CVEs relacionadas — follow-redirects

No mesmo produto, das mais perigosas para as menos.

CVE-2024-28849MEDIUMProxy-Authorization header kept across hosts in follow-redirectsEPSS 1.0%CVE-2026-111756HIGHfollow-redirects array-form headers bypass cross-origin credential strippingEPSS 0.5%CVE-2026-111755HIGHfollow-redirects sensitiveHeaders regex escaping can expose credential headersEPSS 0.5%CVE-2026-116689MEDIUMfollow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsEPSS 0.3%