CVE-2026-44979: 
JavaScript vulnerability analysis and mitigation

CVE-2026-44979 is a sensitive credential header leakage vulnerability in @hapi/wreck, a Node.js HTTP client utility. When the library follows a 3xx redirect to a different hostname, it correctly strips Authorization and Cookie headers but fails to strip the Proxy-Authorization header, potentially exposing forward-proxy credentials to untrusted hosts. All versions of @hapi/wreck prior to 18.1.1 are affected; the issue is fixed in version 18.1.1. It carries a CVSS v4.0 base score of 6.3 (Medium), published on May 27, 2026 (Github Advisory).

The root cause is an incomplete header-stripping allowlist during cross-hostname redirect handling, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-522 (Insufficiently Protected Credentials) (Github Advisory). In the vulnerable code path (lib/index.js), when a redirect targets a different hostname, only authorization and cookie headers are deleted from the outgoing request; proxy-authorization is omitted from this strip set and forwarded intact to the redirect destination. Exploitation requires that the application has explicitly enabled redirect following via the redirects option (set to a positive integer) or Wreck.defaults({ redirects: ... }), since redirect following defaults to false. The fix in PR #312 introduces a sensitiveCrossHostHeaders Set containing authorization, cookie, and proxy-authorization, and iterates over all request headers against this set before following a cross-hostname redirect (wreck PR #312, wreck commit).

Successful exploitation results in the unintended disclosure of Proxy-Authorization credentials to an attacker-controlled or otherwise untrusted hostname that is the target of a 3xx redirect. This is a confidentiality-only impact — there is no integrity or availability impact — but leaked proxy credentials could allow an attacker to authenticate to the forward proxy, potentially enabling unauthorized network access, traffic interception, or lateral movement through internal network segments protected by the proxy. The scope is limited to applications that explicitly enable redirect following and transmit Proxy-Authorization headers (Github Advisory).

1. Identify a target application: Find a Node.js application using @hapi/wreck < 18.1.1 that has redirect following enabled (redirects set to a positive integer) and sends requests with a Proxy-Authorization header through a forward proxy.
2. Control or influence a redirect: Position a server or manipulate DNS/network routing so that the application's HTTP request to a legitimate endpoint receives a 3xx redirect response pointing to an attacker-controlled hostname (e.g., Location: http://attacker.example.com/capture).
3. Receive the leaked header: The vulnerable @hapi/wreck client follows the redirect to the attacker's hostname, forwarding the Proxy-Authorization header intact in the redirected request.
4. Harvest credentials: The attacker's server logs or captures the incoming Proxy-Authorization header value, obtaining the base64-encoded proxy credentials.
5. Abuse credentials: Use the captured proxy credentials to authenticate to the victim's forward proxy, enabling unauthorized outbound network access or further reconnaissance (Github Advisory, wreck PR #312).

• Network: Outbound HTTP/HTTPS requests from a Node.js application to unexpected or newly observed hostnames containing a Proxy-Authorization header; 3xx redirect chains that cross hostname boundaries in application traffic logs.
• Logs: Application or proxy access logs showing Proxy-Authorization headers forwarded to external or untrusted hostnames; HTTP 301/302/307/308 responses from upstream servers redirecting to different domains followed by subsequent requests to those domains with credential headers present.
• Application: Use of @hapi/wreck versions prior to 18.1.1 with redirects option set to a positive integer in application configuration or code (Wreck.defaults({ redirects: N }) or per-request { redirects: N }).

Upgrade @hapi/wreck to version 18.1.1 or later, which adds proxy-authorization to the set of headers stripped on cross-hostname redirects (wreck release v18.1.1). If immediate upgrade is not possible, the following workarounds apply: (1) Leave the redirects option at its default (false) — applications that never enable redirect following are not affected; (2) If redirects are required, set redirects: 0 when calling endpoints with sensitive headers, or manually strip Proxy-Authorization from headers before issuing the request; (3) Use the beforeRedirect hook to manually delete proxy-authorization (and any other sensitive headers) when the redirect targets a different hostname than the original request (Github Advisory).