EUVD-2026-24472Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-triggered with low complexity since redirect following is automatic; no attacker privileges needed; confidentiality impact limited to the leaked header value with no integrity or availability consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
7Blast Radius
ecosystem impact- 356,559 npm packages depend on follow-redirects (7,255 direct, 349,500 indirect)
Ecosystem-wide dependent count for version 1.16.0.
DescriptionCVE.org
follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
AnalysisAI
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers authorization, proxy-authorization, and cookie, leaving headers such as X-API-Key, X-Auth-Token, and Token forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
Technical ContextAI
follow-redirects (CPE: cpe:2.3:a:follow-redirects:follow-redirects:*:*:*:*:*:*:*:*) is an npm package that transparently replaces Node.js's built-in http and https modules with automatic redirect-following behaviour. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is a narrow header-sanitisation regex at index.js lines 469-476: /^(?:(?:proxy-)?authorization|cookie)$/i. This regex fires only when a redirect crosses domain or protocol boundaries, but because it does not cover non-standard header names, any custom credential header escapes sanitisation and is sent to the third-party redirect target. The package is a transitive dependency of axios, meaning virtually all axios-based Node.js applications inherit the exposure when they set custom authentication headers.
RemediationAI
Upgrade follow-redirects to version 1.16.0 or later; the upstream patch is available at commit 844c4d302ac963d29bdb5dc1754ec7df3d70d7f9 in the follow-redirects repository (GHSA-r4q5-vmmm-2653). If using axios, update to a release that pins follow-redirects >= 1.16.0, or explicitly override the dependency in your package.json. Red Hat customers should apply the relevant RHSA errata listed above. Where an immediate upgrade is blocked, a viable compensating control is to avoid setting custom authentication headers in axios instance defaults or global config; instead, apply them selectively via request interceptors that check whether the request host matches the intended domain before attaching the header - this prevents headers from riding along on any automatic redirect. Note this workaround adds interceptor maintenance overhead and must be applied consistently across every axios instance in the application.
More in Follow Redirects
View allVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper h
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today