HIGH 7.5 GitHub
CVE-2026-55553
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
## Summary
urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a **different origin**, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as `Authorization`, `Cookie`, `Proxy-Authorization`, and custom auth headers (`x-api-key`, `x-auth-token`, `x-access-token`).
If the redirect target is attacker-controlled or outside the trust boundary
Affected Products
- npm/urllib >= 3.0.0, <= 4.9.0
- npm/urllib <= 2.44.0
References
- https://github.com/advisories/GHSA-hq3h-g68c-hp78
- https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78
- https://github.com/node-modules/urllib/pull/812
- https://github.com/node-modules/urllib/pull/813
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-25 via GitHub. Affected: npm/urllib >= 3.0.0, <= 4.9.0, npm/urllib <= 2.44.0.
vulnfeed aggregates 11954 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.