Description

undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-11-06T10:16:36.633Z",
  "pubdate": "2026-11-06T10:16:36.633Z",
  "executiveSummary": "The HTTP client library Undici contains a vulnerability where sensitive header stripping logic is bypassed when request headers are provided as an array of name-value tuples. This flaw affects versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3.\nThe vulnerability occurs because the redirect interceptor misinterprets the header input format, causing it to fail to identify and sanitize sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host during cross-origin redirects. This allows these credentials to be disclosed to unauthorized third-party domains.\nThe risk is critical for applications that rely on Undici for handling redirects while simultaneously managing sensitive authentication tokens or session cookies. An attacker capable of influencing the redirect destination can perform exfiltration of these credentials, leading to potential account hijacking or unauthorized access.\nExploitation requires the application to accept user-controlled headers in a tuple-based format and perform cross-origin redirects. Users are advised to upgrade to version 7.30.2 or 8.12.4 immediately.",
  "technicalDetails": "The vulnerability is a representation-dependent bypass of the security protections implemented in CVE-2024-30260. The root cause lies in the redirect interceptor's handling of request headers. Undici supports providing headers as an array of tuples (e.g., [['Authorization', 'Bearer token']]), which is a documented and valid input format.\nWhen a redirect occurs, the interceptor attempts to sanitize sensitive headers before forwarding the request to the new origin. However, the logic responsible for checking these headers expects a specific structure. When the input is supplied as an array of tuples, the interceptor misreads the structure as a flat list, causing the matching algorithm to fail. Consequently, the header names (like 'Authorization') are never matched against the blocklist of sensitive headers.\nThe failure to strip these headers becomes actionable when a header-normalizing interceptor—such as one handling cache or deduplication—is composed outside of the redirect interceptor. Because the redirect handler failed to remove the sensitive headers, the normalizing interceptor processes the original, un-sanitized headers and serializes them onto the cross-origin request. This process effectively leaks sensitive, origin-bound credentials to the unrelated destination defined by the redirect response.\nAttack flow: 1. A client initiates a request to a malicious or compromised server using an array of tuples for sensitive headers. 2. The client receives a redirect response pointing to an attacker-controlled origin. 3. The Undici redirect interceptor, failing to correctly parse the header format, fails to remove the Authorization or Cookie headers. 4. An external normalizing interceptor (e.g., cache) serializes the request, preserving the sensitive headers. 5. The full request, including credentials meant for the initial origin, is transmitted to the attacker-controlled redirect destination. 6. The attacker logs the incoming sensitive headers, facilitating subsequent unauthorized access to the victim's resources.\nThe vulnerability is present in the redirect interceptor component of Undici. It is triggered by specific input formatting and composition of interceptors, irrespective of network exposure or specific privilege requirements, provided the application logic passes user-supplied or sensitive headers to the library."
}