CVE-2026-120415

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.30.1 undici versions 8.0.0 through 8.12.3

Description The redirect interceptor fails to strip sensitive headers—including Authorization, Cookie, Proxy-Authorization, and Host—when a request is redirected to a different origin if the request headers are provided as an array of name and value tuples. In this scenario, the redirect handler misinterprets the tuples as a flat list, preventing the header names from matching and allowing sensitive headers to remain. If a header-normalizing interceptor, such as cache or deduplicate, is composed outside the redirect interceptor, these retained headers are serialized onto the cross-origin request, potentially disclosing origin-bound credentials to an unrelated destination.

Recommendations Update to version 7.30.2 or later. Update to version 8.12.4 or later. Supply request headers as a plain object or a flat name and value array instead of an array of tuples. Compose the redirect interceptor outside the normalizing interceptor.