urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.

A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the leakage of credentials to an attacker-controlled server, potentially allowing the attacker to reuse these credentials against the original service.

Red Hat Ansible Automation Platform 2.1 2026-09-28T00:00:00Z RHSA-2026:72712 ansible-automation-platform/automation-portal:1790254963 Red Hat Ansible Automation Platform 2.2 2026-09-28T00:00:00Z RHSA-2026:72722 ansible-automation-platform/automation-portal:1790256405 Red Hat Developer Hub 1.9 2026-09-21T00:00:00Z RHSA-2026:69248 rhdh/rhdh-hub-rhel9:1789554285 Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-55553 https://nvd.nist.gov/vuln/detail/CVE-2026-55553 https://github.com/node-modules/urllib/commit/7c86c465883ebd3dea5109c87d7bbe3b00960a16 https://github.com/node-modules/urllib/commit/811a8d56e64e540bf6a19bf8b3737692f05d5c46 https://github.com/node-modules/urllib/pull/812 https://github.com/node-modules/urllib/pull/813 https://github.com/node-modules/urllib/releases/tag/v2.44.1 https://github.com/node-modules/urllib/releases/tag/v4.9.1 https://github.com/node-modules/urllib/security/advisories/GHSA-hq3h-g68c-hp78