CVE-2026-55553 urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Attackers can steal sensitive credentials like API keys and cookies when urllib follows cross-origin redirects, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55553?
CVE-2026-55553 is a high-severity vulnerability in node-modules urllib, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.
Which versions are affected by CVE-2026-55553?
4 open source packages ship an affected version, including urllib.
| Package | Affected | Fixed in |
|---|---|---|
urllib npm | All versions | 2.44.1 |
urllib npm | All versions | 2.44.1 |
urllib npm | From 3.0.0 | 4.9.1 |
urllib npm | From 3.0.0 | 4.9.1 |
How do I fix CVE-2026-55553?
Upgrade urllib to a fixed version for your release line: 2.44.1 or 4.9.1.
Is CVE-2026-55553 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55553 exists.
Sources
Also known as AZL-109529, GHSA-hq3h-g68c-hp78, ROOT-APP-NPM-CVE-2026-55553.