CVE-2026-40895

follow-redirects project follow-redirects

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-40895

Katalog CVE

CVSS 7.5 · High EPSS 0,82%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada follow-redirects project follow-redirects. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0.

Rincian

Terbit di NVD
21 April 2026
Terakhir diubah
10 September 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
EPSS (30 hari)
0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
follow-redirects project follow-redirects Semua versi sebelum 1.16.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.