EUVD-2026-24472Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessApp sends HTTP request with X-API-Key header
-
DeliveryAttacker-influenced server returns 302 cross-domain redirect
-
Exploitfollow-redirects follows redirect without stripping custom headers
-
ExecutionX-API-Key forwarded verbatim to attacker-controlled domain
-
PersistAttacker captures credential from server logs
-
ImpactReplays token against original API for unauthorized access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concurrent conditions: (1) the target application uses follow-redirects < 1.16.0, directly or transitively via axios, and sets a non-standard custom authentication header such as |
| Impact | The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) correctly reflects a network-reachable, low-complexity flaw with limited, partial confidentiality impact per the SSVC assessment of 'Technical Impact: partial'. However, when the leaked header is a long-lived API key or session token, the downstream consequence can exceed what 'low' confidentiality suggests - stolen credentials may enable full account takeover of the protected service. Counterbalancing this, the EPSS score of 0.05% (15th percentile) and SSVC 'Exploitation: none' confirm no active exploitation at time of analysis; the flaw is also not listed in CISA KEV. Critically, SSVC flags 'Automatable: no', because the attacker must influence a specific server to return a cross-domain redirect - mass scanning is not a viable approach. On balance, this is a genuine but contextually scoped risk: high priority for Node.js applications making authenticated outbound requests to potentially untrusted or redirect-capable servers, lower priority for applications with fully controlled server environments. |
| Exploit ScenarioDerived | An attacker who controls or has compromised a web service that the target Node.js application communicates with causes that service to return a 302 redirect pointing to an attacker-owned domain. The axios client, via follow-redirects, automatically follows the redirect and forwards the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers authorization, proxy-authorization, and cookie, leaving headers such as X-API-Key, X-Auth-Token, and Token forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
RemediationAI
Upgrade follow-redirects to version 1.16.0 or later; the upstream patch is available at commit 844c4d302ac963d29bdb5dc1754ec7df3d70d7f9 in the follow-redirects repository (GHSA-r4q5-vmmm-2653). If using axios, update to a release that pins follow-redirects >= 1.16.0, or explicitly override the dependency in your package.json. Red Hat customers should apply the relevant RHSA errata listed above. Where an immediate upgrade is blocked, a viable compensating control is to avoid setting custom authentication headers in axios instance defaults or global config; instead, apply them selectively via request interceptors that check whether the request host matches the intended domain before attaching the header - this prevents headers from riding along on any automatic redirect. Note this workaround adds interceptor maintenance overhead and must be applied consistently across every axios instance in the application.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
follow-redirects (CPE: cpe:2.3:a:follow-redirects:follow-redirects:*:*:*:*:*:*:*:*) is an npm package that transparently replaces Node.js's built-in http and https modules with automatic redirect-following behaviour. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is a narrow header-sanitisation regex at index.js lines 469-476: /^(?:(?:proxy-)?authorization|cookie)$/i. This regex fires only when a redirect crosses domain or protocol boundaries, but because it does not cover non-standard header names, any custom credential header escapes sanitisation and is sent to the third-party redirect target. The package is a transitive dependency of axios, meaning virtually all axios-based Node.js applications inherit the exposure when they set custom authentication headers.
Know when Follow Redirects gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-triggered with low complexity since redirect following is automatic; no attacker privileges needed; confidentiality impact limited to the leaked header value with no integrity or availability consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Blast Radius
ecosystem impact- 315 npm packages depend on follow-redirects (16 direct, 299 indirect)
Ecosystem-wide dependent count for version 1.16.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Follow Redirects
View allVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper h
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows
follow-redirects 1.16.0 through 1.16.x before 1.16.1 can disclose Authorization, Proxy-Authorization, Cookie, and caller
Credential header leakage in follow-redirects 1.16.0 allows remote attackers to receive sensitive headers that should ha
Cross-origin credential leakage in follow-redirects 1.16.0 through 1.16.1 lets a custom credential header named in the s
Exploit-DB