---
id: CVE-2026-48022
aliases:
  - GHSA-x426-x7cc-3fpc
title: >-
  @hapi/wreck: Sensitive credential headers leak across cross-port and
  cross-scheme redirects
summary: >-
  @hapi/wreck: Sensitive credential headers leak across cross-port and
  cross-scheme redirects
severity: medium
cvss: 6.5
cwe:
  - CWE-200
  - CWE-319
  - CWE-346
  - CWE-522
  - CWE-940
vendor: hapi
product: '@hapi/wreck'
ecosystem: npm
affected:
  - '@hapi/wreck < 18.1.2'
patched:
  - '@hapi/wreck 18.1.2'
published: '2026-06-11'
updated: '2026-06-11'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-x426-x7cc-3fpc'
references:
  - url: 'https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc'
  - url: >-
      https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e
  - url: 'https://github.com/advisories/GHSA-x426-x7cc-3fpc'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-07T15:41:59.323Z'
epss: 0.00176
epssPercentile: 0.06339
---

## Overview

### Impact
Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. The fix replaces the hostname comparison with a full-origin comparison (scheme, host, and port), aligning the behavior with the WHATWG Fetch same-origin definition used by browsers.

### Patches
Upgrade to >= 18.1.2.

### Workarounds
- Set `redirects: 0` (default) and handle redirects manually with a strict origin check.
- Use the `beforeRedirect` hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.

## Affected packages

- `@hapi/wreck < 18.1.2`

## Remediation

Upgrade to a patched release:

- `@hapi/wreck 18.1.2`