CVE-2026-48022

MediumCVSS 6.5

Published: 17/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

3th percentile - higher than 3% of all known CVEs

Summary

The @hapi/wreck HTTP client before version 18.1.2 has a vulnerability in origin comparison during cross-origin redirects. Credential headers (Authorization, Cookie, Proxy-Authorization) are forwarded across same-host port changes and HTTPS-to-HTTP downgrades, allowing attackers to capture tokens and sessions.

Risk Assessment

Risk of credential theft, session hijacking, and impersonation, leading to unauthorized access to upstream services.

Recommendation

Update @hapi/wreck to version 18.1.2 or later and implement secure redirect configurations.

Other vulnerabilities in @hapi/wreck

CVE-2026-44979Medium
@hapi/wreck prior to 18.1.1, when following a 3xx redirect to a different host, strips only Authorization and Cookie headers but leaves the Proxy-Authorization header. This can expose proxy credentials to an external host if redirects are enabled.

Original NVD description (English source)

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS