6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48022

CVE-2026-48022: @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. This issue is fixed in version 18.1.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48022

CVE-2026-48022:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@hapi/wreck	npm	< 18.1.2	18.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the redirect handling logic of the @hapi/wreck library. When a request is redirected, the library attempts to strip sensitive headers (like Authorization and Cookie) for cross-origin redirects. However, the check for 'cross-origin' was flawed. It only compared the hostname of the original request and the redirect location. It did not consider the port or the scheme (HTTP/HTTPS).

This means if a request to https://example.com was redirected to http://example.com (scheme change) or https://example.com:8080 (port change), the library would consider it a same-origin redirect and would not strip the sensitive headers. This could lead to credential leakage.

The vulnerable function is Client.send in lib/index.js, which contains the faulty logic. The patch corrects this by comparing the full origin (scheme, hostname, and port) of the URLs, ensuring that sensitive headers are stripped for any cross-origin redirect, including those with a different scheme or port on the same hostname.

Vulnerable functions

Client.send

lib/index.js

The function `Client.send` in `lib/index.js` is responsible for making HTTP requests and handling redirects. The vulnerability lies in the insufficient check for cross-origin redirects. The original code only compared hostnames, allowing sensitive headers to be sent to a different port or scheme on the same host. The patch fixes this by comparing the full origin (scheme, host, and port).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.