{"id":"CVE-2026-48022","aliases":["GHSA-x426-x7cc-3fpc"],"title":"@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects","summary":"@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects","severity":"medium","cvss":6.5,"cwe":["CWE-200","CWE-319","CWE-346","CWE-522","CWE-940"],"vendor":"hapi","product":"@hapi/wreck","ecosystem":"npm","affected":["@hapi/wreck < 18.1.2"],"patched":["@hapi/wreck 18.1.2"],"published":"2026-06-11","updated":"2026-06-11","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x426-x7cc-3fpc","references":[{"url":"https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc"},{"url":"https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e"},{"url":"https://github.com/advisories/GHSA-x426-x7cc-3fpc"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-07T15:41:59.323Z","epss":0.00176,"epssPercentile":0.07373,"slug":"CVE-2026-48022","body":"## Overview\n\n### Impact\nWreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. The fix replaces the hostname comparison with a full-origin comparison (scheme, host, and port), aligning the behavior with the WHATWG Fetch same-origin definition used by browsers.\n\n### Patches\nUpgrade to >= 18.1.2.\n\n### Workarounds\n- Set `redirects: 0` (default) and handle redirects manually with a strict origin check.\n- Use the `beforeRedirect` hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.\n\n## Affected packages\n\n- `@hapi/wreck < 18.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@hapi/wreck 18.1.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}