Sensitive Header Exposure in undici HTTP Client for Node.js

CVE-2026-120415

What is CVE-2026-120415?

A vulnerability exists in undici, an HTTP client for Node.js, where the redirect interceptor fails to properly strip sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when requests are redirected to a different origin. This issue arises specifically when request headers are supplied as an array of name and value tuples. The redirect handler incorrectly treats these headers as a flat list, preventing the intended header stripping from occurring. Consequently, if a header-normalizing interceptor is used outside the redirect interceptor, it can serialize retained headers onto a cross-origin request, thus exposing origin-bound credentials to unintended destinations. To mitigate this issue, users are advised to upgrade to the latest versions or alter their request headers to a flat name and value array. The vulnerability was addressed in versions 7.30.2 and 8.12.4.

References