CVE-2026-40895: 
JavaScript vulnerability analysis and mitigation

CVE-2026-40895 is a sensitive information disclosure vulnerability in the follow-redirects Node.js module, where custom authentication headers are leaked to cross-domain redirect targets. When an HTTP request follows a cross-domain redirect (301/302/307/308), the library only strips authorization, proxy-authorization, and cookie headers, leaving custom headers such as X-API-Key, X-Auth-Token, Api-Key, and Token forwarded verbatim to the redirect destination. All versions prior to 1.16.0 are affected. The vulnerability was discovered on 2026-03-20 and disclosed via a GitHub Security Advisory on 2026-04-13, with CVE assignment on 2026-04-21. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, IBM Advisory).

The root cause is improper filtering of HTTP request headers during cross-domain redirects (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The vulnerable code in index.js at lines 469–476 uses a regex (/^(?:(?:proxy-)?authorization|cookie)$/i) that only matches the three standard sensitive headers, leaving any custom authentication header untouched and forwarded to the redirect target domain. An attacker who controls a redirect target — or can intercept/influence server responses to inject a Location header pointing to a malicious domain — can passively receive these credentials without any user interaction. Because follow-redirects is the redirect-handling dependency for the widely-used axios HTTP client (105K+ GitHub stars), the attack surface extends to the entire axios ecosystem in Node.js environments (GitHub Advisory).

Successful exploitation results in the disclosure of custom authentication credentials (e.g., API keys, auth tokens) to untrusted third-party domains, with high confidentiality impact and no integrity or availability impact. An attacker who captures these credentials could gain unauthorized access to backend services or APIs that the affected application communicates with, potentially enabling further lateral movement within the target environment. The broad adoption of follow-redirects via axios means the affected asset scope is extremely wide, spanning any Node.js application that uses axios with custom authentication headers and follows cross-domain redirects (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.05%, indicating a low current probability of exploitation. The vulnerability requires no authentication, no user interaction, and is exploitable over the network, but does require the attacker to control or influence a redirect target. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Multiple IBM products have been identified as affected, including IBM App Connect Enterprise, IBM API Connect, IBM Maximo Application Suite, IBM Aspera Enterprise WebApps, IBM Quantum Safe Explorer, and IBM InfoSphere Optim Archive Viewer (GitHub Advisory, IBM Advisory).

1. Reconnaissance: Identify Node.js applications using axios (or follow-redirects directly) that make HTTP requests with custom authentication headers (e.g., X-API-Key, X-Auth-Token) to endpoints the attacker can influence.
2. Set up malicious redirect target: Stand up an attacker-controlled server (e.g., https://evil.com/steal) capable of logging all incoming HTTP request headers.
3. Inject redirect response: Cause the target application's HTTP endpoint to return a 301, 302, 307, or 308 redirect response with a Location header pointing to the attacker-controlled domain (e.g., via a compromised upstream service, DNS hijacking, or a server-side open redirect).
4. Capture leaked headers: When the vulnerable follow-redirects module automatically follows the cross-domain redirect, it forwards the original custom authentication headers (e.g., X-API-Key: sk-live-secret123) verbatim to the attacker's server.
5. Exploit captured credentials: Use the harvested API keys or tokens to authenticate directly against the victim's backend APIs or services, enabling unauthorized access or further lateral movement (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from application servers to unexpected or unknown external domains, particularly following a redirect chain; presence of custom authentication headers (e.g., X-API-Key, X-Auth-Token) in requests to domains outside the expected set.
• Logs: Application or proxy logs showing HTTP 301/302/307/308 redirect responses from upstream services pointing to external or unfamiliar domains, followed immediately by outbound requests to those domains with authentication headers present.
• Application Behavior: Unexpected API authentication failures or token invalidation events that may indicate credentials have been captured and reused by a third party; anomalous API usage patterns from unfamiliar IP addresses using valid credentials.

The vulnerability is fixed in follow-redirects version 1.16.0. Organizations should immediately upgrade the follow-redirects package to 1.16.0 or later using npm update follow-redirects or by updating the dependency in package.json. As a workaround prior to patching, developers can implement application-level validation of redirect targets before following them, or manually strip custom authentication headers when a cross-domain redirect is detected. IBM has released patches for all affected products including App Connect Enterprise, API Connect, Maximo Application Suite, Aspera Enterprise WebApps, Quantum Safe Explorer, and InfoSphere Optim Archive Viewer — consult the respective IBM security bulletins for product-specific remediation steps (GitHub Advisory, IBM Advisory).

The advisory was published by maintainer RubenVerborgh and credited to researcher Den-Sec, who discovered the issue through source code review on 2026-03-20. The advisory highlights the broad impact on the axios ecosystem (105K+ GitHub stars), which has drawn attention to the systemic risk of transitive dependency vulnerabilities in the Node.js ecosystem. IBM has issued multiple security bulletins across its product portfolio acknowledging the vulnerability, reflecting the wide downstream impact of the flaw (GitHub Advisory, IBM Advisory).