{"id":"CVE-2026-48022","published":"2026-07-17T21:02:05Z","modified":"2026-07-20T19:10:59Z","title":"@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects","vendor":"hapijs","product":"wreck","tier":"tail","description":{"text":"@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00176,"percentile":0.07106,"provenance":"source"},"cwes":[{"id":"CWE-319","name":"Cleartext Transmission of Sensitive Information"},{"id":"CWE-346","name":"Origin Validation Error"},{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/hapijs/wreck/pull/313","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e","tags":["x_refsource_MISC"]},{"url":"https://github.com/hapijs/wreck/releases/tag/v18.1.2","tags":["x_refsource_MISC"]}],"priority":{"score":6.0,"factors":[{"name":"EPSS percentile","points":1.42},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"hapijs","affectedVersions":[{"vendor":"hapijs","product":"wreck","versions":["< 18.1.2"]}],"affected":[{"ecosystem":"npm","package":"@hapi/wreck","vulnerableRanges":["<18.1.2"],"patched":["18.1.2"],"from":["GHSA-x426-x7cc-3fpc"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-45340","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-hapijs-wreck-cve-2024-24758","packageHistory":[{"cve":"CVE-2026-44979","published":"2026-07-17","fixed":"18.1.1","kev":false,"link":{"from":"CVE-2026-44979","to":"CVE-2026-48022","relation":"successor","confidence":"medium","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"npm:@hapi/wreck","fromFixed":"18.1.1","toFixed":"18.1.2","daysApart":0},{"kind":"similar","provenance":"machine","score":0.53,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2026-48022","published":"2026-07-17","fixed":"18.1.2","kev":false}],"package":"npm:@hapi/wreck"}}