HTTP Client Vulnerability in urllib for Node.js Affects User Credentials
CVE-2026-55553
7.5HIGH
What is CVE-2026-55553?
A security issue in urllib, an HTTP client for Node.js, allows for the potential exposure of user credentials through improper handling of redirects. When certain versions of urllib follow redirects, they incorrectly reuse options from the original request. This behavior can lead to sensitive headers, including authorization tokens and cookies, being sent to attacker-controlled redirected origins. As a result, unauthorized parties may gain access to sensitive information, potentially compromising the integrity of user sessions and applications. Users are advised to upgrade to version 2.44.1 or 4.9.1 to mitigate this risk.
Affected Version(s)
urllib >= 3.0.0, < 4.9.1 < 3.0.0, 4.9.1
urllib < 2.44.1 < 2.44.1