CVE-2025-50182 urllib3 does not control redirects in browsers and Node.js
urllib3 fails to enforce redirect controls in Pyodide environments, allowing attackers to bypass redirect restrictions in browser or Node.js contexts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-50182?
CVE-2025-50182 is a medium-severity vulnerability in urllib3, published on 19 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Weakness: CWE-601
Which versions are affected by CVE-2025-50182?
3 open source packages ship an affected version, including urllib3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | From 2.2.0 | 2.5.0 |
urllib3 PyPI | From 2.2.0 | 2.5.0 |
urllib3 PyPI | From 2.2.0 | 2.5.0 |
Products include Python Urllib3.
How do I fix CVE-2025-50182?
Upgrade urllib3 to 2.5.0 or later.
Is CVE-2025-50182 being exploited?
There is no known exploitation of CVE-2025-50182 in the wild and no public exploit code.
Other vulnerabilities in urllib3
- CVE-2026-97689 urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
- CVE-2026-44432 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- CVE-2026-21441 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
- CVE-2025-66418 urllib3 allows an unbounded number of links in the decompression chain
- CVE-2025-66471 urllib3 Streaming API improperly handles highly compressed data
Sources
Also known as BELL-CVE-2025-50182, DEBIAN-CVE-2025-50182, ECHO-3380-b531-9695, GHSA-48p4-8xcf-vxj5, MINI-2xp2-hhm7-7x36, MINI-33pg-98jg-5x3q and 6 more.