6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44979

CVE-2026-44979: @hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

Impact

When @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped. The standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary.

Redirect following is opt-in. The redirects option defaults to false (no redirections followed), so applications are only affected if they have explicitly set redirects to a positive integer on the request or via Wreck.defaults({ redirects: ... }).

Patches

@hapi/wreck 18.1.1 extends the cross-hostname strip set to include proxy-authorization. Upgrade to 18.1.1 or later.

Workarounds

If upgrading is not immediately possible:

Leave redirects at its default (false) — applications that never enable redirect following are not affected.
If redirects are required, set redirects: 0 when calling endpoints with sensitive headers, or strip Proxy-Authorization from the headers before issuing the request.
Use the beforeRedirect hook to manually strip proxy-authorization (and any other sensitive application headers) when redirectOptions targets a different hostname than the original request.

Resources

Related: CVE-2024-30260 / GHSA-3787-6prv-h9w3 (undici)
RFC 7235 §4.4 — Proxy-Authorization

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44979

CVE-2026-44979:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hapi/wreck	npm	< 18.1.1	18.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the @hapi/wreck library's handling of HTTP redirects. Specifically, when a request that includes a Proxy-Authorization header is redirected to a different hostname, the library failed to strip this header before following the redirect. This could lead to the exposure of sensitive proxy credentials to a third-party server.

The patch was identified in commit a5b6fac9c684621c1d5733d10a0257697cfea373. The analysis of this commit reveals changes in lib/index.js within the internals.Client class. The core of the fix is in the request method, which contains the redirect logic. Before the patch, there was a specific check to remove the Authorization and Cookie headers. The patch introduces a new Set called sensitiveCrossHostHeaders which includes authorization, cookie, and, crucially, proxy-authorization. The redirect logic was updated to use this set to determine which headers to strip, thus mitigating the vulnerability. Therefore, the Client.request function is the vulnerable function as it contains the flawed redirect logic.

Vulnerable functions

Client.request

lib/index.js

The `request` method within the `internals.Client` class is responsible for handling HTTP requests and subsequent redirects. The vulnerability lies in the redirect handling logic. When a redirect to a different hostname occurs, the function previously only stripped 'Authorization' and 'Cookie' headers. It failed to remove the 'Proxy-Authorization' header, causing sensitive proxy credentials to be leaked to the new, potentially untrusted, host. The patch fixes this by adding 'proxy-authorization' to a list of sensitive headers that are stripped during cross-hostname redirects.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.