Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-44979— @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects

Quick assessment

Affected
hapijs wreck
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hapijs wreck是hapijs团队的一款HTTP客户端请求库。 hapijs wreck 18.1.1之前版本存在安全漏洞，该漏洞源于在重定向到不同主机名时，未正确处理Proxy-Authorization标头，导致代理凭证可能泄露到原始信任边界之外的主机。

AI Predicted 7.4 Difficulty: Easy EPSS 0.42% · P35

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 1

VendorProduct Version RangeStatus
hapijs wreck < 18.1.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44979

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
Source: CVE Program / CVE List V5
Vulnerability Description
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
hapijs wreck 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
hapijs wreck是hapijs团队的一款HTTP客户端请求库。 hapijs wreck 18.1.1之前版本存在安全漏洞，该漏洞源于在重定向到不同主机名时，未正确处理Proxy-Authorization标头，导致代理凭证可能泄露到原始信任边界之外的主机。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
hapijs wreck < 18.1.1 -

II. Public POCs for CVE-2026-44979

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44979

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-44979 (2)

Vendor Advisories for CVE-2026-44979 (1)

Vendor Pages for CVE-2026-44979 (1)

Same Patch Batch · hapijs · 2026-07-17 · 4 CVEs total

CVE-2026-48022 6.5 MEDIUM @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirect
CVE-2026-48049 5.3 MEDIUM @hapi/inert: Static-file confinement bypass via sibling-prefix path
CVE-2026-44974 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplica

IV. Related Vulnerabilities

Same product: wreck
Same vendor: hapijs
Same weakness: CWE-200