Media

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Publicada: 14.04.2026
Actualizado: 11.10.2026 10:22

Summary

When an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target.

Since follow-redirects is the redirect-handling dependency for axios (105K+ stars), this vulnerability affects the entire axios ecosystem.

Affected Code

index.js, lines 469-476:

if (redirectUrl.protocol !== currentUrlParts.protocol &&
   redirectUrl.protocol !== "https:" ||
   redirectUrl.host !== currentHost &&
   !isSubdomain(redirectUrl.host, currentHost)) {
  removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
}

The regex only matches authorization, proxy-authorization, and cookie. Custom headers like X-API-Key are not matched.

Attack Scenario

App uses axios with custom auth header: headers: { 'X-API-Key': 'sk-live-secret123' }
Server returns 302 Location: https://evil.com/steal
follow-redirects sends X-API-Key: sk-live-secret123 to evil.com
Attacker captures the API key

Impact

Any custom auth header set via axios leaks on cross-domain redirect. Extremely common pattern. Affects all axios users in Node.js.

Suggested Fix

Add a sensitiveHeaders option that users can extend, or strip ALL non-standard headers on cross-domain redirect.

Disclosure

Source code review, manually verified. Found 2026-03-20.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de npm	follow-redirects	< 1.16.0	1.16.0

Referencias

Puntuación CVSS -

Vector CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Debilidad (CWE): CWE-200
Plataforma: npm
Paquete: follow-redirects
Publicada: 14.04.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-r4q5-vmmm-2653 - CC BY 4.0

Historial de vulnerabilidades: follow-redirects

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 5
Primera → última: 01.2022 04.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 1
Media 4

Divulgaciones por año

2022: 2
2023: 0
2024: 2
2025: 0
2026: 1

14.04.2026

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets esta entrada

Media CVE-2026-40895 < 1.16.0 1.16.0
14.03.2024

follow-redirects' Proxy-Authorization header kept across hosts

Media · 6.5 CVE-2024-28849 < 1.15.6 1.15.6
02.01.2024

Follow Redirects improperly handles URLs in the url.parse() function

Media · 6.1 CVE-2023-26159 < 1.15.4 1.15.4
10.02.2022

Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects

Media · 5.9 CVE-2022-0536 < 1.14.8 1.14.8
12.01.2022

Exposure of sensitive information in follow-redirects

Alta · 8.0 CVE-2022-0155 < 1.14.7 1.14.7

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación