CVE-2026-48022 Details

A vulnerability in the @hapi/wreck HTTP client utility, affecting versions prior to 18.1.2, allows for the leakage of sensitive credential headers, including Authorization, Cookie, and Proxy-Authorization, across cross-origin redirects. While Wreck removes these headers before following a redirect, the origin check only compares hostnames, ignoring the scheme and port. This oversight enables the forwarding of credentials intact during same-host port changes and HTTPS-to-HTTP downgrades. Consequently, a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect could capture bearer tokens, session cookies, and proxy credentials, potentially allowing impersonation of the victim against the upstream service.

Users are advised to upgrade to version 18.1.2 or later. For those unable to upgrade, set 'redirects' to 0 and handle redirects manually with a strict origin check, or use the 'beforeRedirect' hook to inspect the redirect target and strip sensitive headers before following the redirect.