CVE catalog

CVE-2026-40895

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirec

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-follow-redirectssid1.16.1+~1.14.4-1fixed
Debiannode-follow-redirectsforky1.16.1+~1.14.4-1fixed
Debiannode-follow-redirectstrixie1.15.9+~1.14.4-1vulnerable
Debiannode-follow-redirectsbookworm1.15.2+~1.14.1-1vulnerable
Cpenode-follow-redirectsNot reportedNot reportedvulnerable
Cpefollow-redirectsNot reported1.16.0fixed
Ubuntunode-follow-redirectsnoble1.15.6+~1.14.4-1ubuntu0.1~esm1fixed
Npmfollow-redirectsNot reported1.16.0fixed
Cpefollow-redirectsNot reported1.16.0fixed
Ubuntunode-follow-redirectspro1.15.9+~1.14.4-1vulnerable
Ubuntunode-follow-redirectspro1.15.11+~1.14.4-1build1vulnerable
Ubuntunode-follow-redirectspro1.15.11+~1.14.4-1ubuntu0.1~esm1fixed
Ubuntunode-follow-redirectspro1.15.9+~1.14.4-1vulnerable
Ubuntunode-follow-redirectspro1.15.11+~1.14.4-1build1vulnerable
Ubuntunode-follow-redirectspro1.15.11+~1.14.4-1ubuntu0.1~esm1fixed
Ubuntunode-follow-redirects25.101.15.9+~1.14.4-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-follow-redirectssourcesid1.16.0+~1.14.4-1not yet assignedNot reported[1134646]
Debiannode-follow-redirectssourceforky1.16.0+~1.14.4-1not yet assignedNot reported[1134646]
Debiannode-follow-redirectssourcetrixie(unfixed)not yet assignedNot reported[1134646]
Debiannode-follow-redirectssourcebookworm(unfixed)not yet assignedNot reported[1134646]
Cpefollow-redirectscpeNot reported1.16.0Not reportedNot reportedNot reported
Ubuntunode-follow-redirectsdebnoble1.15.6+~1.14.4-1ubuntu0.1~esm1Not reportedNot reportedNot reported
Npmfollow-redirectsnpmNot reported1.16.0Not reportedGHSA-R4Q5-VMMM-2653Not reported
Cpefollow-redirectscpeNot reported1.16.0Not reportedNVD-CVE-2026-40895Not reported
Ubuntunode-follow-redirectsdebpro1.15.11+~1.14.4-1ubuntu0.1~esm1Not reportedUSN-8632-1Not reported
Ubuntunode-follow-redirectsdebpro1.15.11+~1.14.4-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-40895Not reported

[Debian bug #1134646]

Notes

[trixie] node-follow-redirects: Minor issue [bookworm] node-follow-redirects: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-follow-redirects]Affected
    Details (2)

    • 1.15.2+~1.14.1-1 · all · bookworm

      Affected

      nvd · node-follow-redirects · debian · bookworm; nvd · node-follow-redirects · debian · 12

    • 1.15.2+~1.14.1-1 · all · bookworm

      Affected

      nvd · node-follow-redirects · debian · bookworm; nvd · node-follow-redirects · debian · 12

[Debian 13 (Trixie)]

  • [node-follow-redirects]Affected
    Details (2)

    • 1.15.9+~1.14.4-1 · all · trixie

      Affected

      nvd · node-follow-redirects · debian · 13

    • 1.15.9+~1.14.4-1 · all · trixie

      Affected

      nvd · node-follow-redirects · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]