CVE-2026-55553

HighCVSS 7.5

Published: 25/08/2026(UTC)Updated: 09/09/2026(UTC)Translated: 25/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

30th percentile - higher than 30% of all known CVEs

Summary

urllib for Node.js before versions 4.9.1 and 2.44.1 reuses caller-supplied options across redirects, including authorization headers and credentials, even when the redirect target has a different scheme, host, or port. This can cause sensitive credentials to be sent to an attacker-controlled redirected origin. This issue is fixed in versions 2.44.1 and 4.9.1.

Risk Assessment

An attacker could intercept credentials intended for the original service, potentially leading to unauthorized access to APIs or related services.

Recommendation

It is recommended to upgrade urllib to version 2.44.1 or 4.9.1. Also, review redirect configurations and avoid sending sensitive headers to external domains.

Other vulnerabilities in urllib

CVE-2021-3733Medium
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client connects to could trigger a Regular Expression Denial of Service (ReDoS) during an authentication request with a specially crafted payload sent by the server to the client. The greatest threat is to application availability.

Original NVD description (English source)

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS