Skip to main content
cve.nowby Sazabi
← npm
npmPackage

urllib

1 known vulnerability (1 high), with the versions each affects and the releases that fix them.

Latest release
4.9.0 (Dec 13, 2025): affected by CVE-2026-55553
Newest unaffected release
4.9.1 (Jun 13, 2026)
Advisories
1 · 1 high
Weekly downloads
901.4K
Dependents
430
Releases
250 since 0.0.1 (May 16, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-55553
    Affects 0.0.1 to 2.44.0 (2.44.1 is outside it); 3.0.0 to 4.9.0 (4.9.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

    Affected: from 3.0.0, fixed in 4.9.1; fixed in 2.44.1.

    Fixed in 2.44.1 (released Jun 13, 2026, 73 days before disclosure) and 4.9.1 (released Jun 13, 2026, 73 days before disclosure).

    The latest release, 4.9.0, is still affected.

    49% of urllib downloads last week were affected versions (470.3K).