node-modules urllib vulnerabilities

Latest node-modules urllib CVEs

Newest publication first

1. CVE-2026-55553 urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

   Published 2026-08-25

   High·CVSS 7.5

   urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.