CVE-2026-48022 Overview
CVE-2026-48022 affects @hapi/wreck, an HTTP client utility used across Node.js applications. Versions prior to 18.1.2 strip credential headers on cross-origin redirects but perform the origin comparison using hostname only. The check ignores URL scheme and port, so Authorization, Cookie, and Proxy-Authorization headers travel intact across same-host port changes and HTTPS-to-HTTP downgrades.
An attacker capable of forging or influencing a redirect can capture bearer tokens, session cookies, and proxy credentials. This maps to [CWE-319: Cleartext Transmission of Sensitive Information]. The maintainers fixed the flaw in version 18.1.2 by comparing full URL origins.
Critical Impact
Co-tenants on adjacent ports and network-position attackers can harvest bearer tokens and session cookies to impersonate victims against upstream services.
Affected Products
- @hapi/wreck versions prior to 18.1.2
- Node.js applications and libraries that depend on @hapi/wreck as an HTTP client
- Downstream @hapi framework consumers using Wreck for outbound HTTP requests
Discovery Timeline
- 2026-07-17 - CVE-2026-48022 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-48022
Vulnerability Analysis
Wreck removes sensitive headers when following a redirect that crosses hosts. The pre-patch logic compared only the hostname property of the current request URI and the redirect Location. Two requests to example.com:443 and example.com:8080 are treated as same-origin under that comparison, as are https://example.com and http://example.com.
When the check evaluates as same-origin, Wreck forwards the original request headers to the redirect target. This exposes any bearer token, session cookie, or proxy credential attached to the outbound request. A co-tenant service running on an adjacent port receives the raw credentials and can replay them against the intended upstream.
Root Cause
The root cause is an incomplete same-origin check. RFC 6454 defines origin as the tuple of scheme, host, and port. Comparing hostname only violates that definition and produces false same-origin matches whenever the scheme or port differs.
Attack Vector
Exploitation requires user interaction in the form of an initial request that follows redirects. A network-position attacker who can inject a 3xx response, or a co-tenant controlling a service on an adjacent port of the same host, redirects the client to a listener they operate. The redirected request arrives with credential headers intact, giving the attacker material to impersonate the victim.
redirectOptions.timeout = (redirectOptions.timeout - elapsed).toString(); // stringify to not drop timeout when === 0
}
- // When redirecting to a new hostname, remove sensitive credential headers
+ // When redirecting cross-origin (scheme, host, or port differs), remove sensitive credential headers
if (redirectOptions.headers) {
const parsedLocation = new URL(location);
- if (uri.hostname !== parsedLocation.hostname) {
+ if (uri.origin !== parsedLocation.origin) {
for (const header of Object.keys(redirectOptions.headers)) {
if (internals.sensitiveCrossHostHeaders.has(header.toLowerCase())) {
delete redirectOptions.headers[header];
Source: GitHub Commit b93323b. The patch replaces the hostname comparison with an origin comparison, which incorporates scheme, host, and port.
Detection Methods for CVE-2026-48022
Indicators of Compromise
- Outbound HTTP requests carrying Authorization, Cookie, or Proxy-Authorization headers to unexpected ports on the same hostname as a legitimate upstream.
- HTTP 3xx responses received from intermediaries that redirect to http:// targets when the original request was https://.
- Replay of bearer tokens or session cookies from source IPs that do not match established client patterns for the upstream service.
Detection Strategies
- Inventory Node.js projects and lockfiles for @hapi/wreck versions below 18.1.2 using software composition analysis.
- Log outbound redirect chains from services using Wreck and alert when the target origin differs by scheme or port from the initial request.
- Correlate authentication logs on upstream APIs with unexpected client identifiers or user-agent strings following a redirect event.
Monitoring Recommendations
- Instrument HTTP client wrappers to record Location header values and flag redirects that change scheme from HTTPS to HTTP.
- Monitor proxy and egress logs for credential-bearing requests to non-standard ports on known upstream hostnames.
- Track dependency drift in CI so builds that introduce vulnerable @hapi/wreck versions fail before deployment.
How to Mitigate CVE-2026-48022
Immediate Actions Required
- Upgrade @hapi/wreck to version 18.1.2 or later in all direct and transitive dependencies.
- Rotate bearer tokens, session cookies, and proxy credentials used by services that made outbound requests through vulnerable Wreck versions.
- Audit outbound HTTP integrations for redirect handling and confirm no cross-scheme or cross-port credential exposure occurred.
Patch Information
The fix is available in Wreck v18.1.2. The change replaces the uri.hostname !== parsedLocation.hostname check with uri.origin !== parsedLocation.origin, ensuring credential headers are stripped whenever scheme, host, or port differs. See Pull Request #313 and GHSA-x426-x7cc-3fpc for full details.
Workarounds
- Disable automatic redirect following by setting redirects: 0 on Wreck requests until the library is upgraded.
- Strip Authorization, Cookie, and Proxy-Authorization headers manually in application code before invoking Wreck for cross-boundary calls.
- Restrict outbound egress from Node.js services so redirects to unexpected ports or plaintext HTTP endpoints are blocked at the network layer.
# Upgrade to patched version
npm install @hapi/wreck@^18.1.2
# Verify installed version
npm ls @hapi/wreck
# Audit for known vulnerabilities
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
