CVE-2026-55553: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in node-modules urllib

The urllib Node.js HTTP client improperly reuses caller-supplied options, including sensitive headers and authentication tokens, when following redirects to different origins. Specifically, in versions before 2.44.1 and 4.9.1, the internal request method recursively calls itself with the same options object, causing credentials intended for the original origin to be sent to redirected URLs with different schemes, hosts, or ports. This leads to exposure of sensitive information such as Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers to potentially attacker-controlled endpoints. The vulnerability is identified as CWE-200 (Exposure of Sensitive Information) and has a CVSS 3.1 score of 7.5 (High).

Sensitive authentication credentials and tokens can be leaked to attacker-controlled redirect destinations without any user interaction. This exposure could allow attackers to capture credentials intended for trusted origins and potentially reuse them against the original API or related services, leading to unauthorized access or data compromise.

This vulnerability is fixed in urllib versions 2.44.1 and 4.9.1. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated beyond the fixed versions, so users should verify with the vendor advisory for the latest remediation guidance.