Is CVE-2026-120415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120415 being exploited in the wild.

How severe is CVE-2026-120415?

Medium severity, with a CVSS score of 5.9, published 6 November 2026.

Which products and versions are affected?

Nodejs Undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3.

How is CVE-2026-120415 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120415?

Check whether you run Nodejs Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120415: undici cross-origin credential disclosure via array-of-tuples headers

CVE-2026-120415 · Severity: medium · CVSS 5.9 · Published 2026-11-06

undici is an HTTP client library for Node.js that handles web requests and redirects. A vulnerability in versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 allows sensitive credentials like authentication tokens and cookies to leak to unrelated websites when a redirect occurs, if request headers are formatted in a specific way. An attacker controlling a redirect destination could capture credentials intended only for the original server.

Vendors: Nodejs.

Quick answers

Is CVE-2026-120415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120415 being exploited in the wild.
How severe is CVE-2026-120415?: Medium severity, with a CVSS score of 5.9, published 6 November 2026.
Which products and versions are affected?: Nodejs Undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3.
Is there a fix for CVE-2026-120415?: Yes: fixed in undici 7.30.2, 8.12.4. Until then: Supply request headers as a plain object or flat [name, value, name, value] array rather than an array of [name, value] tuples, or compose the redirect() interceptor outside normalizing interceptors (cache() or deduplicate()). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120415 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120415?: Check whether you run Nodejs Undici at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: undici 7.30.2, 8.12.4

Supply request headers as a plain object or flat [name, value, name, value] array rather than an array of [name, value] tuples, or compose the redirect() interceptor outside normalizing interceptors (cache() or deduplicate()).

Technical details

The redirect interceptor fails to strip sensitive headers (Authorization, Cookie, Proxy-Authorization, Host) when headers are supplied as an array of [name, value] tuples instead of a flat array or object. The interceptor misinterprets tuple format as a flat list, causing header name comparisons to fail and sensitive headers to be retained. When a normalizing interceptor (cache or deduplicate) composes outside the redirect interceptor, it serializes these retained headers onto cross-origin requests, disclosing origin-bound credentials.

Affected products

nodejs undici 7.0.0 through 7.30.1, 8.0.0 through 8.12.3

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.