CVE-2026-44979

MediumCVSS 6.3

Published: 17/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

@hapi/wreck prior to 18.1.1, when following a 3xx redirect to a different host, strips only Authorization and Cookie headers but leaves the Proxy-Authorization header. This can expose proxy credentials to an external host if redirects are enabled.

Risk Assessment

An attacker controlling the redirect target can capture proxy credentials, enabling impersonation of the client and access to internal resources.

Recommendation

Upgrade @hapi/wreck to version 18.1.1. Consider disabling automatic redirects if not needed.

Other vulnerabilities in @hapi/wreck

CVE-2026-48022Medium
The @hapi/wreck HTTP client before version 18.1.2 has a vulnerability in origin comparison during cross-origin redirects. Credential headers (Authorization, Cookie, Proxy-Authorization) are forwarded across same-host port changes and HTTPS-to-HTTP downgrades, allowing attackers to capture tokens and sessions.

Original NVD description (English source)

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS