CVE-2026-55553: urllib Node.js Information Disclosure Flaw

CVE-2026-55553 Overview

The urllib HTTP client for Node.js contains an information disclosure vulnerability that leaks authentication credentials across origins during redirect handling. Versions prior to 2.44.1 and 4.9.1 reuse caller-supplied request options when following redirects, including sensitive headers such as Authorization, Cookie, and Proxy-Authorization. When a redirect points to a different scheme, host, or port, these headers are forwarded to the new origin. An attacker controlling a redirect target can capture credentials intended for the original service. The flaw is tracked as CWE-200: Exposure of Sensitive Information and requires no user interaction.

Critical Impact
Cross-origin redirects leak Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers to attacker-controlled hosts, enabling credential theft and replay against the original partner API.

Affected Products

urllib (node-modules/urllib) versions prior to 2.44.1 in the 2.x branch
urllib (node-modules/urllib) versions prior to 4.9.1 in the 4.x branch
Node.js applications and downstream libraries that depend on vulnerable urllib releases

Discovery Timeline

2026-08-25 - CVE-2026-55553 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55553

Vulnerability Analysis

The vulnerability resides in the redirect-following logic of urllib. In src/HttpClient.ts, the private method #requestInternal recursively invokes itself with the next URL and the same options object: this.#requestInternal(nextUrl.href, options, requestContext). Because options.headers, options.auth, and options.digestAuth are reused without cross-origin filtering, they follow the request to any redirect target.

When a server responds with a 3xx redirect pointing to a different origin, the client transmits the original credential headers to that new host. The exposed headers include Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token. This behavior violates the WHATWG Fetch specification, which requires stripping credential-bearing headers on cross-origin redirects.

Root Cause

The root cause is missing origin comparison between the current request URL and the redirect Location target before forwarding request options. The library did not maintain a list of sensitive headers to strip when scheme, host, or port changed. Any HTTP client that treats redirects as transparent continuations of the original request risks this class of information disclosure.

Attack Vector

An attacker needs the ability to influence a redirect response returned to a urllib caller. Common scenarios include compromising an upstream service, controlling a URL parameter that becomes a request target, or operating a malicious partner API that returns a 301, 302, 303, 307, or 308 pointing to attacker infrastructure. Once the redirect is followed, the credential headers are delivered to the attacker-controlled origin and can be replayed against the legitimate service.

typescript

// Security patch in src/HttpClient.ts (PR #812)
// Source: https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46
   308, // Permanent Redirect
 ];

+// Credential-bearing headers that must not be forwarded across an origin
+// boundary when following a redirect, to avoid leaking them to a third party.
+// Matches the WHATWG Fetch spec and undici's RedirectHandler.
+// https://fetch.spec.whatwg.org/#http-redirect-fetch
+const CrossOriginSensitiveHeaders = new Set(['authorization', 'cookie', 'proxy-authorization']);
+
 export class HttpClient extends EventEmitter {
   #defaultArgs?: RequestOptions;
   #dispatcher?: Dispatcher;

The legacy 2.x branch received an equivalent fix in lib/urllib.js that introduces CROSS_ORIGIN_SENSITIVE_HEADERS, a resolveOriginHref helper, and an isCrossOriginRedirect check. Source: GitHub Commit 7c86c465.

Detection Methods for CVE-2026-55553

Indicators of Compromise

Outbound HTTP requests from Node.js services carrying Authorization, Cookie, or x-api-key headers to unexpected external domains
Application logs showing 3xx redirects from trusted APIs to third-party hosts followed by successful requests
Dependency manifests (package.json, package-lock.json, yarn.lock) listing urllib at versions below 2.44.1 or 4.9.1

Detection Strategies

Perform a software composition analysis (SCA) scan across repositories and container images to identify vulnerable urllib versions in the dependency graph.
Inspect egress proxy logs for requests where a redirect chain crosses origin boundaries while credential headers remain present.
Audit source code for callers that pass followRedirect: true alongside Authorization, auth, or digestAuth options.

Monitoring Recommendations

Alert on unexpected destination hostnames appearing in outbound API traffic from services that call known partner endpoints.
Track secret usage telemetry from API gateways and identity providers to detect credential reuse from unfamiliar IP ranges.
Enable structured logging of redirect events in urllib callers and forward the logs to a centralized data lake for correlation.

How to Mitigate CVE-2026-55553

Immediate Actions Required

Upgrade urllib to 4.9.1 for the 4.x branch or 2.44.1 for the 2.x branch across all Node.js services.
Rotate any API keys, session cookies, or bearer tokens that may have been transmitted through cross-origin redirects while the vulnerable version was in use.
Review outbound traffic logs for the past retention window to identify redirect chains that terminated at untrusted origins.

Patch Information

The issue is resolved in urllib v4.9.1 and urllib v2.44.1. The fixes are delivered through Pull Request #812 and Pull Request #813, and documented in GHSA-hq3h-g68c-hp78.

Workarounds

Set followRedirect: false on requests that carry credentials and handle redirects manually with explicit origin checks.
Strip Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token from the options.headers object before any request that could redirect.
Restrict outbound traffic from Node.js workloads to an allowlist of known API hostnames using an egress proxy or service mesh policy.

bash

# Update urllib to a patched version
npm install urllib@^4.9.1

# Or for the legacy branch
npm install urllib@^2.44.1

# Verify the installed version
npm ls urllib