Is CVE-2026-48022 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48022 being exploited in the wild.

How severe is CVE-2026-48022?

Medium severity, with a CVSS score of 6.5, published 17 July 2026.

Which products and versions are affected?

Hapi Wreck < 18.1.2; @hapi/wreck (npm) < 18.1.2, SEMVER:introduced=0,fixed=18.1.2.

Is there a fix for CVE-2026-48022?

Yes. @hapi/wreck (npm): upgrade to 18.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48022 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48022?

Check whether you run Hapi Wreck or @hapi/wreck (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48022: hapijs @hapi/wreck credential leak in cross-origin redirects

Q: Which products and versions are affected?

Hapi Wreck < 18.1.2; @hapi/wreck (npm) < 18.1.2, SEMVER:introduced=0,fixed=18.1.2.

Q: Is there a fix for CVE-2026-48022?

Yes. @hapi/wreck (npm): upgrade to 18.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48022 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48022?

Check whether you run Hapi Wreck or @hapi/wreck (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48022 · Severity: medium · CVSS 6.5 · Published 2026-07-17

@hapi/wreck is a software tool used by developers to make web requests. A security flaw in how it handles web redirects could allow an attacker to steal sensitive login information, such as session cookies or security tokens. This happens because the tool may accidentally send your private credentials to an untrusted server if it is redirected to a different port or an unencrypted connection on the same host.

Vendors: Hapi, npm.

Quick answers

Is CVE-2026-48022 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48022 being exploited in the wild.
How severe is CVE-2026-48022?: Medium severity, with a CVSS score of 6.5, published 17 July 2026.
Which products and versions are affected?: Hapi Wreck < 18.1.2; @hapi/wreck (npm) < 18.1.2, SEMVER:introduced=0,fixed=18.1.2.
Is there a fix for CVE-2026-48022?: Yes. @hapi/wreck (npm): upgrade to 18.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48022 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48022?: Check whether you run Hapi Wreck or @hapi/wreck (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hapi/wreck (npm): upgrade to 18.1.2 or later
```
npm install @hapi/wreck@18.1.2
```

Technical details

A vulnerability exists in @hapi/wreck prior to version 18.1.2 where the library's origin validation logic only compares hostnames during HTTP redirects. It fails to account for the URI scheme and port number. Consequently, sensitive headers such as 'Authorization', 'Cookie', and 'Proxy-Authorization' are forwarded during HTTPS-to-HTTP downgrades or redirects to different ports on the same host. An attacker positioned on the network or a co-tenant on the same host could exploit this to capture credentials and impersonate users. The fix implements a full-origin comparison (scheme, host, and port) consistent with the WHATWG Fetch standard.

Affected products

hapijs wreck < 18.1.2

Identifiers

CVE-2026-48022
GHSA-x426-x7cc-3fpc

Timeline

2026-05-20: patched: Fix committed and version 18.1.2 released
2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.