AIKIDO-2026-10741

TL;DR

The 0.x HTTP client merges configuration and headers in ways that historically supported prototype-chain lookups and loose object shape checks across adapters. Serialized errors could expose sensitive fields when logs or telemetry stringify error payloads. Node-side fetching treated proxy environment semantics and Unix socket paths with less enforcement than modern threat models expect. The release tightens merging and adapter reads with null-prototype merges and own-property checks, redacts sensitive keys during error serialization by default, improves NO_PROXY matching for IPv6-mapped forms, strips Proxy-Authorization when no proxy applies, gates socketPath behind an allowlist, and hardens URL parameter encoding.