The follow-redirects library used by axios in Node.js versions prior to 1.16.0 does not strip custom authentication headers on cross-domain HTTP redirects. Only standard headers like authorization, proxy-authorization, and cookie are removed, allowing headers such as X-API-Key or X-Auth-Token to be forwarded to potentially malicious redirect targets. This can lead to leakage of sensitive authentication tokens to attacker-controlled domains.