CVE-2026-55553
1 advisory.
npm/urllib CVE-2026-55553: high 7.5, EPSS 0.66%
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
Action: Upgrade urllib to 2.44.1 or later.
npm i urllib@4.9.1npm i urllib@2.44.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 4.9.1 | - |
| 0 | 2.44.1 | - |
Fixed versions
| 4.9.1 | 2.44.1 |
Sources
- osv: GHSA-hq3h-g68c-hp78
- https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78
- https://github.com/node-modules/urllib/pull/812
- https://github.com/node-modules/urllib/pull/813
- https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16
- https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46
- https://github.com/node-modules/urllib
- https://github.com/node-modules/urllib/releases/tag/v2.44.1
- https://github.com/node-modules/urllib/releases/tag/v4.9.1
CVE-2026-55553 · published · modified · JSON