CVE-2026-48022

Name of the Vulnerable Software and Affected Versions @hapi/wreck versions prior to 18.1.2

Description This HTTP client utility fails to properly validate origins during cross-origin redirects. While it strips credential headers such as Authorization, Cookie, and Proxy-Authorization, the origin check only compares hostnames and ignores the scheme and port. Consequently, credentials are forwarded during same-host port changes and HTTPS-to-HTTP downgrades. This allows a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials to impersonate the victim against the upstream service.

Recommendations Update to version 18.1.2 or later. Set redirects: 0 and handle redirects manually with a strict origin check. Use the beforeRedirect hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.