6.9
Medium
CVE-2026-40895 follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…
Description
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| follow-redirects 1.16 | earliest → < 1.16.0 | 1.16.0 |
| Cryostat 4 on RHEL 9 4.2 | earliest → < 4.2.0-9 | 4.2.0-9 |
| Cluster Observability Operator 1.5.0 1781116392 | earliest → < 1781116392 | 1781116392 |
| Network Observability (NETOBSERV) 1.11.2 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 1780876734 | earliest → < 1780876734 | 1780876734 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Advanced Cluster Security for Kubernetes 4.10 1779293013 | earliest → < 1779293013 | 1779293013 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat Ansible Automation Platform 2.5 1780082949 | earliest → < 1780082949 | 1780082949 |
Show the 86 other branches Hide the 86 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Developer Hub 1.8 1779841586 | earliest → < 1779841586 | 1779841586 |
| Red Hat Developer Hub 1.9 1777903262 | earliest → < 1777903262 | 1777903262 |
| Red Hat Discovery 2 1778156756 | earliest → < 1778156756 | 1778156756 |
| Red Hat OpenShift AI 2.25 1787801527 | earliest → < 1787801527 | 1787801527 |
| Red Hat OpenShift AI 3.3 1778666987 | earliest → < 1778666987 | 1778666987 |
| Red Hat OpenShift Container Platform 4.19 1784634877 | earliest → < 1784634877 | 1784634877 |
| Red Hat OpenShift Container Platform 4.20 1784731014 | earliest → < 1784731014 | 1784731014 |
| Red Hat OpenShift Container Platform 4.21 1784713762 | earliest → < 1784713762 | 1784713762 |
| Red Hat OpenShift Dev Spaces 3.28 1779359423 | earliest → < 1779359423 | 1779359423 |
| Red Hat OpenShift Service Mesh 2.6 1778191378 | earliest → < 1778191378 | 1778191378 |
| Red Hat OpenShift Service Mesh 3.0 1778164208 | earliest → < 1778164208 | 1778164208 |
| Red Hat OpenShift Service Mesh 3.1 1778164042 | earliest → < 1778164042 | 1778164042 |
| Red Hat OpenShift Service Mesh 3.2 1778163909 | earliest → < 1778163909 | 1778163909 |
| Red Hat OpenShift Service Mesh 3.3 1778163986 | earliest → < 1778163986 | 1778163986 |
| Red Hat Quay 3.12 1779811412 | earliest → < 1779811412 | 1779811412 |
| Red Hat Quay 3.14 1779689392 | earliest → < 1779689392 | 1779689392 |
| Red Hat Quay 3.15 1780891395 | earliest → < 1780891395 | 1780891395 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.17 1779922205 | earliest → < 1779922205 | 1779922205 |
| Red Hat Quay 3.1 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Quay 3.9 1779811473 | earliest → < 1779811473 | 1779811473 |
| multicluster engine for Kubernetes 2.10 1780917531 | earliest → < 1780917531 | 1780917531 |
| multicluster engine for Kubernetes 2.11 1780910888 | earliest → < 1780910888 | 1780910888 |
| multicluster engine for Kubernetes 2.6 1778511348 | earliest → < 1778511348 | 1778511348 |
| multicluster engine for Kubernetes 2.8 1778383863 | earliest → < 1778383863 | 1778383863 |
| multicluster engine for Kubernetes 2.9 1778532610 | earliest → < 1778532610 | 1778532610 |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| OpenShift Pipelines | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published | |
| Red Hat build of Apicurio Registry 2 | Versions not published | |
| Red Hat build of Apicurio Registry 3 | Versions not published | |
| Red Hat Build of Podman Desktop | Versions not published | |
| Red Hat Build of Podman Desktop - Tech Preview | Versions not published | |
| Red Hat Connectivity Link 1 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Cryostat 4 | Versions not published | |
| Gatekeeper 3 | Versions not published | |
| Migration Toolkit for Virtualization | Versions not published | |
| Node HealthCheck Operator | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Ceph Storage 9 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat Edge Manager 1 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Hardened Images | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift distributed tracing 3 | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Trusted Artifact Signer | Versions not published | |
| Red Hat Trusted Profile Analyzer | Versions not published | |
| streams for Apache Kafka 2 | Versions not published | |
| streams for Apache Kafka 3 | Versions not published | |
| Red Hat Quay 3.10 1779822261 | earliest → < 1779822261 | 1779822261 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 | earliest → < 1783451729 | 1783451729 |
| Red Hat OpenShift Service Mesh 3 1778164208 | earliest → < 1778164208 | 1778164208 |
| multicluster engine for Kubernetes 2.1 1780917531 | earliest → < 1780917531 | 1780917531 |
| multicluster engine for Kubernetes 2.11.0 1780910888 | earliest → < 1780910888 | 1780910888 |
| Red Hat Advanced Cluster Security 4.9 1779371594 | earliest → < 1779371594 | 1779371594 |
| Red Hat OpenShift Container Platform 4.2 1784731014 | earliest → < 1784731014 | 1784731014 |
| Red Hat Migration Toolkit 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Red Hat OpenShift Container Platform 4.22 1784125329 | earliest → < 1784125329 | 1784125329 |
| multicluster engine for Kubernetes 2.9.0 1778532610 | earliest → < 1778532610 | 1778532610 |
| Network Observability (NETOBSERV) 1.11.1 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16.0 1780600823 | earliest → < 1780600823 | 1780600823 |
| Red Hat Migration Toolkit for Applications 8.1 1785169013 | earliest → < 1785169013 | 1785169013 |
| Red Hat OpenShift Container Platform 4.17 1784803344 | earliest → < 1784803344 | 1784803344 |
| Red Hat OpenShift Container Platform 4.18 1785278569 | earliest → < 1785278569 | 1785278569 |
| Network Observability (NETOBSERV) 1.11.0 1778510461 | earliest → < 1778510461 | 1778510461 |
| Red Hat Migration Toolkit for Containers 1.8 1783690532 | earliest → < 1783690532 | 1783690532 |
| Cluster Observability Operator 1.5.2 1781116392 | earliest → < 1781116392 | 1781116392 |
References
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of follow-redirects
The 5 CVEs of follow-redirects →
CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
5.9
Medium
CVE-2026-111756
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
8.2
High
CVE-2026-111755
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects
8.2
High
CVE-2024-28849
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…
6.5
Medium