CVE-2026-48022Medium· 6.5▾ Sunlit@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. The fix replaces the hostname comparison with a full-origin comparison (scheme, host, and port), aligning the behavior with the WHATWG Fetch same-origin definition used by browsers.
Upgrade to >= 18.1.2.
redirects: 0 (default) and handle redirects manually with a strict origin check.beforeRedirect hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.@hapi/wreck < 18.1.2Upgrade to a patched release:
@hapi/wreck 18.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-50017Mediumpnpm binds unscoped user-level npm auth credentials to a repository-selected registry
CVE-2026-45726High· 7.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
CVE-2026-50025Medium· 6.9Mousehole is a background service to update a seedbox IP for MAM and web app to manage it
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2026-44979None@hapi/wreck is an HTTP client utility