AIKIDO-2026-564744

TL;DR

The Node HTTP path in @whatwg-node/fetch builds the redirect request by reusing the original request's Headers object, so Authorization, Cookie, Cookie2, Proxy-Authorization, and an explicit Host header are sent to a different origin on a cross-origin redirect, leaking credentials to the redirect target. An https to http downgrade redirect leaks them too, since the scheme is part of the origin, while same-origin redirects are unaffected and the caller's original Headers object is not modified. The patch rebuilds the redirect request's headers, strips these headers on cross-origin hops, and rejects cors-mode cross-origin redirects whose target URL embeds credentials.