Executive brief
urllib is a Node.js HTTP client library used to make web requests from applications. When configured to follow redirects, urllib fails to strip sensitive headers (like authorization tokens and session cookies) when a redirect points to a different web origin, potentially exposing credentials to attacker-controlled destinations. An application making an authenticated request to a trusted partner could have its credentials leaked if that partner returns a redirect to an attacker's server.
Technical details
urllib contains an insecure redirect-handling vulnerability in the `#requestInternal` method (src/HttpClient.ts:639-656). When processing HTTP redirects (3xx status codes), the library recursively calls itself with the redirect target URL but reuses the original `options` object verbatim, including all caller-supplied request headers. This means credential-bearing headers such as `Authorization`, `Cookie`, `Proxy-Authorization`, and custom headers (`x-api-key`, `x-auth-token`, `x-access-token`) are forwarded to the redirect destination without origin validation. An attacker who controls a redirect target or compromises an intermediary can capture these credentials. Unlike other popular Node.js HTTP clients tested (undici, node-fetch, superagent, needle, etc.) which strip at least authorization and cookie headers on cross-origin redirects, urllib v4.9.0 strips none. The vulnerability affects versions ≤4.9.0 (and ≤2.44.0 for the v2 branch) and is patched in v4.9.1 and v2.44.1.
Affected products
- node-modules urllib <=4.9.0, <=2.44.0
Timeline
- 2026-06-13: disclosed: Published in GitHub Advisory Database
- 2026-08-25: advisory: Updated in GitHub Advisory Database
- 2026: patched: Patches released: v4.9.1 and v2.44.1