urllib Cross-Origin Redirect Credential Leakage

The Node.js library urllib contains a vulnerability (CVE-2026-55553) where credential-bearing request headers are preserved verbatim when following HTTP redirects across different origins. While standard HTTP client behavior typically involves stripping sensitive authentication headers when a request is redirected to a different domain, urllib v4.9.0 and earlier versions (including the 2.x branch) fail to implement this security control. This allows an attacker who controls a redirect destination, or who can influence the Location header of an initial request, to capture sensitive data such as Authorization tokens, Cookie session strings, and Proxy-Authorization credentials. The vulnerability is triggered automatically when followRedirect is set to true, requiring no user interaction. This poses a significant risk to applications that handle sensitive API requests or user sessions through the affected library.

Impact

The impact of this vulnerability is the unauthorized exfiltration of sensitive credentials to attacker-controlled infrastructure. By redirecting a legitimate client request to a malicious origin, an attacker can capture authentication tokens, enabling them to potentially impersonate the client or access protected resources on the original target system. This vulnerability affects any Node.js environment utilizing urllib for external communication. Given the automated nature of redirect following, services that interface with dynamic or third-party content are at the highest risk of accidental credential exposure.

Recommendation

• Update urllib to a patched version once available that implements header sanitization for cross-origin requests.
• Implement a wrapper or interceptor around urllib.request that checks the domain of the Location header during a redirect and strips sensitive headers if the origin changes.
• Audit applications using urllib to identify code paths where followRedirect is enabled and potentially sensitive headers (Authorization, Cookie) are passed in the options object.
• Review network egress logs for unexpected connections from your backend services to unknown or untrusted external domains.