---
id: CVE-2026-55553
title: >-
  urllib is an HTTP client for Node.js that supports authentication, redirects,
  timeouts, and other request features
summary: >-
  urllib is an HTTP client for Node.js that supports authentication, redirects,
  timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib
  follows redirects through followRedirect but reuses caller-supplied options
  across orig…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-201
  - CWE-522
vendor: urllib
product: urllib
affected:
  - 'urllib >= 3.0.0, <= 4.9.0'
  - urllib <= 2.44.0
patched:
  - urllib 4.9.1
  - urllib 2.44.1
published: '2026-08-25'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:07:31.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55553'
references:
  - url: >-
      https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16
    label: security-advisories@github.com
  - url: >-
      https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46
    label: security-advisories@github.com
  - url: 'https://github.com/node-modules/urllib/pull/812'
    label: security-advisories@github.com
  - url: 'https://github.com/node-modules/urllib/pull/813'
    label: security-advisories@github.com
  - url: 'https://github.com/node-modules/urllib/releases/tag/v2.44.1'
    label: security-advisories@github.com
  - url: 'https://github.com/node-modules/urllib/releases/tag/v4.9.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78
    label: security-advisories@github.com
  - url: >-
      https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-hq3h-g68c-hp78'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55553.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-55553'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2523609'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-55553'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55553'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69248'
tags:
  - nvd
  - ghsa
  - npm
  - csaf
  - vex
  - red-hat
epss: 0.0037
epssPercentile: 0.30738
aliases:
  - GHSA-hq3h-g68c-hp78
ecosystem: npm
ingestedAt: '2026-08-25T16:28:50.861Z'
---

## Overview

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55553)

Affected packages:

- `urllib >= 3.0.0, <= 4.9.0`
- `urllib <= 2.44.0`

Patched in:

- `urllib 4.9.1`
- `urllib 2.44.1`

Source: https://github.com/advisories/GHSA-hq3h-g68c-hp78

## Vendor advisories

- **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248)
- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55553.json)