fix(deps): update dependency urllib to v4 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
urllib	^3.3.0 → ^4.0.0

---

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

CVE-2026-55553 / GHSA-hq3h-g68c-hp78

More information

Details

Summary

urllib supports redirect-following through followRedirect, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a different origin, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as Authorization, Cookie, Proxy-Authorization, and custom auth headers (x-api-key, x-auth-token, x-access-token).

If the redirect target is attacker-controlled or outside the trust boundary of the original target, credentials intended for the original origin can be delivered to the redirected origin. In a local multi-library reproduction, urllib v4.9.0 was the only tested client that stripped no headers on cross-origin redirect.

Affected behavior

Confirmed against urllib v4.9.0. The relevant code is in #requestInternal (src/HttpClient.ts:639-656):

     // https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections
      if (RedirectStatusCodes.includes(res.statusCode) && maxRedirects > 0 && requestContext.redirects < maxRedirects) {
        if (res.headers.location) {
          requestContext.redirects++;
          const nextUrl = new URL(res.headers.location, requestUrl.href);
          // Ensure the response is consumed
          await response.body.arrayBuffer();
          debug(
            'Request#%d got response, status: %s, headers: %j, timing: %j, redirect to %s',
            requestId,
            res.status,
            res.headers,
            res.timing,
            nextUrl.href,
          );
          return await this.#requestInternal(nextUrl.href, options, requestContext);
        }
      }

The recursive call this.#requestInternal(nextUrl.href, options, requestContext) reuses the original options object. If the caller supplied credential-bearing headers in options.headers, those headers are reused for the redirected request, regardless of whether the redirect target shares the original origin.

Redirect-header handling context

The CHANGELOG suggests that redirect-related header handling has been considered before, including changes around preserving or cleaning up Host during redirects. Given that context, sensitive-header stripping may be an unintentional gap rather than an explicit policy decision.

Proof of Concept: 3-container topology

The reproduction uses three separate containers (partner, attacker, client) connected over a Podman bridge network. Each container has its own hostname, port, and process, so the redirect crosses a clear origin boundary. This is not a localhost vs 127.0.0.1 same-host case.

[client container]                       [partner container]              [attacker container]
hostname: client                         hostname: partner                hostname: attacker
                                         port: 3001                       port: 3002
   urllib v4.9.0
        │
        │ GET http://partner:3001/start
        │ + 6 credential-bearing headers
        ↓
                                         302 Location:
                                         http://attacker:3002/captured
                                                   │
                                                   │ urllib follows redirect
                                                   │ → DIFFERENT ORIGIN
                                                   │   (different hostname and port)
                                                   │ → all 6 headers preserved
                                                   ↓
                                                                          headers logged
                                                                          inside attacker
                                                                          container

The origin tuple is (scheme, host, port):

• source origin: http://partner:3001
• destination origin: http://attacker:3002

The host and port both differ, so the redirect target is a different URL origin. The headers are logged in a separate process inside a separate container.

Client invocation (client/poc.mjs):

import urllib from 'urllib' // v4.9.0

await urllib.request('http://partner:3001/start', {
  followRedirect: true,
  maxRedirects: 5,
  headers: {
    'Authorization': 'Bearer LIVE-AUTH-3CONTAINER',
    'Cookie': 'session=LIVE-COOKIE-3CONTAINER',
    'Proxy-Authorization': 'Bearer proxy-LIVE-3CONTAINER',
    'x-api-key': 'sk-LIVE-3CONTAINER-x123',
    'x-auth-token': 'auth-LIVE-3CONTAINER-y456',
    'x-access-token': 'access-LIVE-3CONTAINER-z789',
  },
})

Observed result
urllib 4.9.0, Node.js 22.22.2, linux/arm64:

[attacker] CAPTURED HEADERS:
  "authorization":       "Bearer LIVE-AUTH-3CONTAINER"
  "cookie":              "session=LIVE-COOKIE-3CONTAINER"
  "proxy-authorization": "Bearer proxy-LIVE-3CONTAINER"
  "x-api-key":           "sk-LIVE-3CONTAINER-x123"
  "x-auth-token":        "auth-LIVE-3CONTAINER-y456"
  "x-access-token":      "access-LIVE-3CONTAINER-z789"
  "user-agent":          "node-urllib/4.9.0 Node.js/22.22.2 (linux; arm64)"

LEAK RATE: 6/6

The user-agent value confirms that the redirected request was sent by urllib v4.9.0.

Independent reproduction: multi-library comparison

A separate local harness tested the same cross-origin redirect topology against multiple Node.js HTTP clients:

• same partner:3001 → attacker:3002 redirect;
• same six credential-bearing headers;
• same RFC 6454 origin boundary.

The results were deterministic across runs:

Library	Leak rate	Headers stripped on cross-origin redirect
undici 6.21.0	3/6	authorization, cookie, proxy-authorization
needle 3.5.0	3/6	authorization, cookie, proxy-authorization
node-fetch 3.3.2	4/6	authorization, cookie
superagent 10.3.0	4/6	authorization, cookie
@​hapi/wreck 18.1.0	4/6	authorization, cookie
request 2.88.2	5/6	authorization
urllib 4.9.0	6/6	none

urllib was the only tested library that stripped no headers on cross-origin redirect. Custom auth headers such as x-api-key, x-auth-token, and x-access-token are an ecosystem-wide gap in this comparison. The urllib-specific issue is the absence of any strip step for standard credential-bearing headers such as Authorization, Cookie, and Proxy-Authorization.

The reproduction harness is small and can be shared if useful.

Impact

This affects Node.js applications that use urllib to make authenticated HTTP requests while allowing redirects to be followed automatically.

1. Application sends an authenticated request:
     GET https://api.partner.example/data
     Authorization: Bearer <token>
     Cookie: session=<session-id>

2. The partner endpoint, a compromised intermediary, or a misconfigured CDN returns:
     302 Location: https://attacker.example/captured

3. urllib follows the redirect and sends the original Authorization and Cookie headers
   to attacker.example.

This exposes credentials to an origin that was not the intended recipient. Depending on the credential type and server-side validation, the leaked credentials may be reusable against the original partner API or related services.

This requires no user interaction. Realistic triggers include compromised partner subdomains, DNS hijacking, malicious partner endpoints during onboarding, internal services redirecting across trust boundaries, or an open redirect upstream of urllib's call site.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78
• https://github.com/node-modules/urllib/pull/812
• https://github.com/node-modules/urllib/pull/813
• https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16
• https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46
• https://github.com/node-modules/urllib/releases/tag/v2.44.1
• https://github.com/node-modules/urllib/releases/tag/v4.9.1
• https://github.com/advisories/GHSA-hq3h-g68c-hp78

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

node-modules/urllib (urllib)

v4.9.0

Compare Source

• feat: enable isolatedDeclarations (#​615) (374402e), closes #​615 hi#level
• chore: enable oxfmt (#​602) (948f05d), closes #​602 hi#level
• chore: enable tsgo on typecheck (#​605) (41f6277), closes #​605 hi#level
• chore: fix auto release (8f13384)
• chore(deps): update actions/checkout action to v6 (#​600) (75685a1), closes #​600
• chore(deps): update actions/setup-node action to v6 (#​596) (d4fd7cf), closes #​596
• chore(deps): update codecov/codecov-action digest to 671740a (#​608) (2734504), closes #​608
• chore(deps): update dependency @​tsconfig/node18 to v18.2.6 (#​603) (23ffca2), closes #​603
• chore(deps): update dependency @​tsconfig/strictest to v2.0.8 (#​604) (0fc042a), closes #​604
• chore(deps): update dependency @​types/node to v22.19.2 (#​610) (a9ace96), closes #​610
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20251210.1 (#​609) (dc1ed3e), closes #​609
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20251211.1 (#​613) (8f6fdaa), closes #​613
• chore(deps): update dependency @​typescript/native-preview to v7.0.0-dev.20251213.1 (#​619) (11b3bec), closes #​619
• chore(deps): update dependency cross-env to v10.1.0 (#​612) (0f68029), closes #​612
• chore(deps): update dependency form-data to v4.0.5 (#​606) (ab3d22f), closes #​606
• chore(deps): update dependency oxlint to v1.32.0 (#​614) (8118abb), closes #​614
• chore(deps): update dependency typescript to v5.9.3 (#​607) (cda0e13), closes #​607
• chore(deps): update dependency undici to v7.16.0 (#​617) (ca378bc), closes #​617
• chore(deps): update pnpm to v10.25.0 (#​618) (708b985), closes #​618

v4.8.2

Compare Source

• fix: enumerable WellFormed (0b1e89d)
• chore: ignore pnpm-lock.yaml (3cc8971)
• chore: migrate from ESLint to oxlint with @​eggjs/oxlint-config extension (#​590) (1ae3fd7), closes #​590
• chore: typo fix on release task name (54aa22a)

v4.8.1

Compare Source

• chore: add GIT_TOKEN (baabae9)
• chore: use npm trusted publisher (#​589) (8f2ed13), closes #​589
• chore(deps): update dependency cross-env to v10 (#​584) (ad4405a), closes #​584
• chore(deps): update dependency selfsigned to v3 (#​582) (9e62fb1), closes #​582
• fix: patch undici File support on Node.js < 20 (#​588) (0e5ad19), closes #​588

v4.8.0

Compare Source

Features

• add isSentByFetch/fetchOpaque to urllib message (#​581) (d7e9f40)

v4.7.1

Compare Source

Bug Fixes

• compatible with urllib@​2 timeout string format (#​580) (5eaf790)

v4.7.0

Compare Source

Features

• support multiple fetch_factory instances (#​579) (d09d316)

v4.6.12

Compare Source

Bug Fixes

• compatible with pool stats reading (#​578) (13a29af)

v4.6.11

Compare Source

Bug Fixes

• compressed option should be false by default (#​567) (a0a8dc5)

v4.6.10

Compare Source

Bug Fixes

• should HEAD request keepalive by default (#​566) (54c4a2c)

v4.6.9

Compare Source

Bug Fixes

• should got undici:client:sendHeaders message on H2 (#​553) (bd19f6d)

v4.6.8

Compare Source

Bug Fixes

• patch TransformStream on Node.js 16 (#​564) (503dbd8)

v4.6.7

Compare Source

Bug Fixes

• should not throw when fetch a Request with post (#​563) (6f9f353)

v4.6.6

Compare Source

Bug Fixes

• allow set rejectUnauthorized = true on urllib.request options (#​561) (88785e1)

v4.6.5

Compare Source

Bug Fixes

• set opaque on request (#​560) (8cf5c3b)

v4.6.4

Compare Source

Bug Fixes

• export WebFormData (#​559) (dec6b12)

v4.6.3

Compare Source

Bug Fixes

• only set extend notation on non-ascii filename (#​558) (0cd9b06)

v4.6.2

Compare Source

Bug Fixes

• fix socket info if fetch failed (#​556) (e9f4258)

v4.6.1

Compare Source

Bug Fixes

• compatible with pool stats reading (#​578) (13a29af)

v4.6.0

Compare Source

Features

• exports undici (#​554) (3c9fca7)

v4.5.1

Compare Source

Bug Fixes

• support use on Node.js 16 (#​550) (78e1336)

v4.5.0

Compare Source

Features

• upgrade to undici v7 (#​547) (9803c4e)

v4.4.0

Compare Source

Features

• impl fetch (#​542) (55a634c)

v4.3.1

Compare Source

Bug Fixes

• add export type (#​540) (1765806)

v4.3.0

Compare Source

Features

• Added support for x-www-authenticate header (#​533) (d52a3e0)

v4.2.2

Compare Source

Bug Fixes

• uncaught exception due to second response with digest auth (#​530) (9a7833e)

v4.2.1

Compare Source

Bug Fixes

• allow ":" character in digestAuth password (#​532) (c6b6f88)

v4.2.0

Compare Source

Features

• add hostname for checkAddress (#​525) (88b6e56)

v4.1.0

Compare Source

Features

• support HTTP2 (#​518) (21d4260)

v4.0.0

Compare Source

⚠ BREAKING CHANGES

• drop Node.js < 18.19.0 support

part of eggjs/egg#3644

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​urllib@​3.27.3 ⏵ 4.9.1	-3	+16

View full report