npm/follow-redirects CVE-2026-40895: high 7.5, EPSS 0.49%
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets
Action: Upgrade follow-redirects to 1.16.0 or later.
npm i follow-redirects@1.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.16.0 | - |
Fixed versions
| 1.16.0 |
Sources
- osv: GHSA-r4q5-vmmm-2653
- nvd: CVE-2026-40895
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653
- https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9
- https://github.com/follow-redirects/follow-redirects
CVE-2026-40895 · published · modified · JSON