# CVE-2026-48022: hapijs @hapi/wreck credential leak in cross-origin redirects

Source: https://junglewise.ai/threats/cve-2026-48022-hapijs-hapi-wreck-credential-leak-in-cross-origin-redirects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-48022 · Severity: medium · CVSS 6.5 · Published 2026-07-17

@hapi/wreck is a software tool used by developers to make web requests. A security flaw in how it handles web redirects could allow an attacker to steal sensitive login information, such as session cookies or security tokens. This happens because the tool may accidentally send your private credentials to an untrusted server if it is redirected to a different port or an unencrypted connection on the same host.

Vendors: [Hapi](https://junglewise.ai/threats/vendors/hapi), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-48022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48022 being exploited in the wild.

**How severe is CVE-2026-48022?** Medium severity, with a CVSS score of 6.5, published 17 July 2026.

**Which products and versions are affected?** Hapi Wreck < 18.1.2; @hapi/wreck (npm) < 18.1.2, SEMVER:introduced=0,fixed=18.1.2.

**Is there a fix for CVE-2026-48022?** Yes. @hapi/wreck (npm): upgrade to 18.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48022 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48022?** Check whether you run Hapi Wreck or @hapi/wreck (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @hapi/wreck (npm): upgrade to 18.1.2 or later

  ```sh
  npm install @hapi/wreck@18.1.2
  ```


## Technical details

A vulnerability exists in @hapi/wreck prior to version 18.1.2 where the library's origin validation logic only compares hostnames during HTTP redirects. It fails to account for the URI scheme and port number. Consequently, sensitive headers such as 'Authorization', 'Cookie', and 'Proxy-Authorization' are forwarded during HTTPS-to-HTTP downgrades or redirects to different ports on the same host. An attacker positioned on the network or a co-tenant on the same host could exploit this to capture credentials and impersonate users. The fix implements a full-origin comparison (scheme, host, and port) consistent with the WHATWG Fetch standard.

## Affected products

- hapijs wreck < 18.1.2

## Identifiers

- CVE-2026-48022
- GHSA-x426-x7cc-3fpc

## Timeline

- 2026-05-20: patched: Fix committed and version 18.1.2 released
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e](https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e)
- [https://github.com/hapijs/wreck/pull/313](https://github.com/hapijs/wreck/pull/313)
- [https://github.com/hapijs/wreck/releases/tag/v18.1.2](https://github.com/hapijs/wreck/releases/tag/v18.1.2)
- [https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc](https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc)

## Related threats

- [hapi wreck sensitive information leak in Proxy-Authorization header](https://junglewise.ai/threats/cve-2026-44979-hapi-wreck-sensitive-information-leak-in-proxy-authorization)