All vulnerabilities

npm

CVE-2026-40895

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Severity: Medium
Published: 14 Apr 2026
Last changed: 10 Sept 2026
Added to UpHeron: 22 Oct 2026
Fixed in: 1.16.0
Also known as: GHSA-r4q5-vmmm-2653
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
follow-redirectsnpm · `osv:npm:follow-redirects`	Every version before 1.16.0

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40895
GitHub Advisory Database https://github.com/advisories/GHSA-r4q5-vmmm-2653