{"id":"CVE-2026-44979","published":"2026-07-17T21:01:01Z","modified":"2026-07-20T14:35:45Z","title":"@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects","vendor":"hapijs","product":"wreck","tier":"tail","description":{"text":"@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0042,"percentile":0.36337,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/hapijs/wreck/pull/312","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapijs/wreck/releases/tag/v18.1.1","tags":["x_refsource_MISC"]}],"priority":{"score":11.7,"factors":[{"name":"EPSS percentile","points":7.27},{"name":"CVSS severity","points":4.41}]},"vendorSlug":"hapijs","affectedVersions":[{"vendor":"hapijs","product":"wreck","versions":["< 18.1.1"]}],"affected":[{"ecosystem":"npm","package":"@hapi/wreck","vulnerableRanges":["<18.1.1"],"patched":["18.1.1"],"from":["GHSA-vhjm-w67q-g75c"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-45339","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hapijs-wreck-cve-2024-24758","parents":[{"from":"CVE-2024-24758","to":"CVE-2026-44979","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-vhjm-w67q-g75c","via":"reference","url":"https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3"}]}],"packageHistory":[{"cve":"CVE-2026-44979","published":"2026-07-17","fixed":"18.1.1","kev":false},{"cve":"CVE-2026-48022","published":"2026-07-17","fixed":"18.1.2","kev":false,"link":{"from":"CVE-2026-44979","to":"CVE-2026-48022","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:@hapi/wreck","fromFixed":"18.1.1","toFixed":"18.1.2","daysApart":0},{"kind":"similar","provenance":"machine","score":0.53,"basis":"same product + CWE + description similarity"}]}}],"package":"npm:@hapi/wreck"}}