Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48022— @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Quick assessment

Affected
hapijs wreck
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hapijs wreck是hapijs团队的一款HTTP客户端请求库。 hapijs wreck 18.1.2之前版本存在安全漏洞，该漏洞源于重定向处理逻辑不当，在跨源重定向前仅比较主机名而忽略协议和端口，导致凭证信息被完整转发，可能允许相邻端口的同租户或能伪造重定向的网络攻击者捕获令牌、会话Cookie和代理凭证，进而冒充受害者攻击上游服务。

CVSS 6.5 · Medium EPSS 0.18% · P7

Affected Version Matrix 1

VendorProduct Version RangeStatus
hapijs wreck < 18.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48022

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
Source: CVE Program / CVE List V5
Vulnerability Description
@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
hapijs wreck 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
hapijs wreck是hapijs团队的一款HTTP客户端请求库。 hapijs wreck 18.1.2之前版本存在安全漏洞，该漏洞源于重定向处理逻辑不当，在跨源重定向前仅比较主机名而忽略协议和端口，导致凭证信息被完整转发，可能允许相邻端口的同租户或能伪造重定向的网络攻击者捕获令牌、会话Cookie和代理凭证，进而冒充受害者攻击上游服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
hapijs wreck < 18.1.2 -

II. Public POCs for CVE-2026-48022

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-48022

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48022 (2)

Vendor Advisories for CVE-2026-48022 (1)

Vendor Pages for CVE-2026-48022 (1)

Same Patch Batch · hapijs · 2026-07-17 · 4 CVEs total

CVE-2026-48049 5.3 MEDIUM @hapi/inert: Static-file confinement bypass via sibling-prefix path
CVE-2026-44974 Parameter smuggling in @hapi/content header parser allows upload-filter bypass via duplica
CVE-2026-44979 @hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirect

IV. Related Vulnerabilities

Same product: wreck
Same vendor: hapijs
Same weakness: CWE-319