CVE-2026-120415

The undici HTTP client for Node.js (versions 7.0.0–7.30.1 and 8.0.0–8.12.3) contains a vulnerability where the redirect interceptor fails to strip sensitive headers—such as Authorization , Cookie , Proxy-Authorization , and Host —during cross-origin redirects when headers are provided as an array...