CVE-2026-44979: hapijs wreck

Vulnerability summary

CVE-2026-44979 is a medium (CVSS 6.3) vulnerability in hapijs wreck. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.9% of scored vulnerabilities.

Timeline

1. 17-07-2026
   PublishedVulnerability first disclosed.
2. 20-07-2026
   Last modifiedVulnerability information updated.

Description

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.