undici implements a redirect interceptor that should strip sensitive headers such as Authorization, Cookie, Proxy‑Authorization, and Host when a request is redirected to another origin. In vulnerable releases the interceptor mis‑interprets request headers delivered as an array of name/value tuples and therefore does not recognize the sensitive header names. When a subsequent interceptor normalizes or de‑duplicates headers, the preserved headers are then serialized onto the cross‑origin request, exposing the caller’s origin‑bound credentials to an unrelated domain. This flaw allows an attacker to read or reuse credentials that were intended to remain private to the original origin. The vulnerability is a form of information exposure identified by CWE‑200 and CWE‑212.

The issue affects undici version 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the HTTP client library for Node.js. The fix is available in 7.30.2 and 8.12.4 and later releases.

The vulnerability carries a CVSS score of 5.9, indicating medium severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page or script that uses undici to perform a cross‑origin HTTP request; the attacker needs the ability to influence the headers passed to the library. Once exploited, the attacker can obtain sensitive credentials bound to the original origin, potentially leading to credential theft or privilege escalation within the victim’s application.