High, CVSS 7.5npmPublished
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
CVE-2026-55553 · GHSA-hq3h-g68c-hp78
- Affected
- npm urllib >= 3.0.0, <= 4.9.0; <= 2.44.0
- Fixed in
- 2.44.14.9.1· Vendor fix available
- Issue
- urllib supports redirect-following through followRedirect, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a different origin, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as Authorization, Cookie, Proxy-Authorization, and custom auth headers (x-api-key, x-auth-token, x-access-token). If the redirect target is attacker-controlled or outside the trust boundary of the original target, credentials intended for the original origin can be delivered to the redirected origin. In a local multi-library reproduction, urllib v4.9.0 was the only tested client that stripped no headers on cross-origin redirect. Affected behavior Confirmed against urllib v4.9.0. The relevant code is in #requestInternal (src/HttpClient.ts:639-656): The recursive call this.#requestInternal(nextUrl.href, options, requestContext) reuses the original options object. If the caller supplied credential-bearing…
Recommended action: Upgrade to 4.9.1 or 2.44.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.