Executive brief
urllib3 does not control redirects in browsers and Node.js
Affected products
- PyPI urllib3
Junglewise Threat Intelligence
CVE-2025-50182: PYSEC-2026-1997 - urllib3 does not control redirects in browsers and Node.js
CVE-2025-50182 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: urllib3 (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1999 - urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
- PYSEC-2026-1995 - urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
- urllib3 resource exhaustion via improper handling of compressed data
- urllib3 sensitive header leak in ProxyManager low-level redirects
- Python urllib3 denial of service via decompression bomb in redirects