USY-2026-0117 · Exposure of sensitive information · score 7.6

Proxy credentials leaked to the destination host

Proxy-Authorization survives the transition from proxy tunnel to origin request, disclosing proxy credentials to the destination.

SyntheticThis advisory is invented for the demonstration. requests is a real package; nothing described here has been reported against it.

Affected package

requests

Affected releases

3 from 2.28.0

Fixed in

2.32.0

Published

14 Feb 2026

Blast radius

2 of 12 · nearest 2

Admin ConsoleInternal Tools2 hops

Application
Admin Console
Hop 1declared · 5.1.0
@tanstack/react-query5.1.0
Faulttransitive · ^2.29.0
requests2.29.0
Affected. Fixed in 2.32.0.

Docs SiteMarketing2 hops

Not reached · 10Auth Gateway, Checkout Service, Data Exporter, Fraud Scoring, Inventory Sync, Ledger API, Mobile BFF, Notification Relay, Reporting Pipeline, Storefront Web

Where to cut

@tanstack/react-query carries 2 of 2

Drop the application at one end and the flawed release at the other, and count what is left in the middle. @tanstack/react-query sits on 2 of the 2 shortest paths, which makes it the cheapest single place to break the chain.

@tanstack/react-query 5.1.0on 2 of 2 paths

Admin Console · Docs Site

Affected releases

2.29.017 Jul 2025

2.28.39 Dec 2024

2.28.025 May 2024

Package role

HTTP client17M downloads/wk

Who can publish it

2 accounts

Felix Sandovalfelix-sandoval2FA on Wei Haddadwei-haddad2FA on