urllib, a popular Node.js HTTP client, incorrectly reuses user‑supplied request headers and authentication data when following redirects to a different origin. The flaw allows an attacker to capture credentials such as Authorization, Cookie, Proxy‑Authorization, x‑api‑key, x‑auth‑token, and x‑access‑token that were intended for a trusted destination and leak them to a malicious redirect target. As a result, sensitive authentication information may be exposed and reused against the original API or related services, enabling credential replay or unauthorized access. The vulnerability is exploitable without any user interaction, and the problem exists in all releases before urllib 2.44.1 and 4.9.1.

The issue affects the urllib library included as node‑modules; all versions prior to 2.44.1 and 4.9.1 are vulnerable. Users deploying these versions in Node.js applications, especially those that perform cross‑origin redirects, are at risk unless the library is updated to the patched releases.

The CVSS score of 7.5 indicates a high‑severity condition, and the vulnerability is listed as not present in the CISA KEV catalog. Although EPSS data are unavailable, the flaw can be triggered automatically whenever a redirect to a different scheme, host, or port occurs. Attackers can set up a server that issues redirect responses to luring clients that use urllib, causing credential leakage. Because no special privileges or user interaction are required, the exploit is likely to be widespread in production deployments that rely on older urllib versions.