CVE-2026-48022: 
JavaScript vulnerability analysis and mitigation

CVE-2026-48022 is a credential header leakage vulnerability in @hapi/wreck, a Node.js HTTP client utility, where sensitive headers are incorrectly forwarded during cross-origin redirects. The flaw exists in all versions prior to 18.1.2 and was discovered by researcher SnailSploit, with the advisory published on May 20, 2026, and added to the GitHub Advisory Database on June 11, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is an origin validation error (CWE-346) in Wreck's redirect-following logic: the cross-origin check compared only hostnames (uri.hostname !== parsedLocation.hostname) rather than full origins, ignoring scheme and port. This means that when a server issues a redirect from https://example.com:443 to http://example.com:8080, Wreck incorrectly treats the destination as same-origin and forwards Authorization, Cookie, and Proxy-Authorization headers intact. The fix, applied in commit b93323b, replaces the hostname comparison with a full-origin comparison (uri.origin !== parsedLocation.origin), aligning behavior with the WHATWG Fetch same-origin definition. Additional CWEs include CWE-200 (Exposure of Sensitive Information), CWE-319 (Cleartext Transmission), CWE-522 (Insufficiently Protected Credentials), and CWE-940 (Improper Verification of Source of a Communication Channel) (GitHub Advisory, Fix Commit).

Successful exploitation allows a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect response to capture bearer tokens, session cookies, and proxy credentials transmitted by the victim application. The attacker can then impersonate the victim against upstream services, leading to unauthorized account access and potential lateral movement within multi-tenant or shared-infrastructure environments. Confidentiality impact is rated High, while integrity and availability are unaffected (GitHub Advisory).

1. Identify a target application: Find a Node.js application using @hapi/wreck versions prior to 18.1.2 that follows HTTP redirects with credential headers (e.g., Authorization or Cookie) and is reachable from a network-adjacent position or shares infrastructure with the attacker.
2. Position for redirect interception: Either operate a service on an adjacent port of the same hostname (co-tenant scenario) or achieve a network-position capable of forging HTTP redirect responses (e.g., via ARP spoofing, DNS manipulation, or a compromised intermediate server).
3. Trigger a redirect: Cause the vulnerable Wreck client to make an HTTP request to a URL you control or can influence, and respond with a 302 Location header pointing to a different port or downgrading from HTTPS to HTTP on the same hostname (e.g., Location: http://example.com:8080/capture).
4. Capture forwarded credentials: Because Wreck's origin check only compares hostnames, it forwards Authorization, Cookie, and Proxy-Authorization headers to the redirect destination. Collect these headers at the attacker-controlled endpoint.
5. Impersonate the victim: Use the captured bearer tokens, session cookies, or proxy credentials to authenticate against the upstream service as the victim (GitHub Advisory, Fix Commit).

• Network: Unexpected HTTP requests containing Authorization, Cookie, or Proxy-Authorization headers directed at non-standard ports or HTTP endpoints where HTTPS would be expected; outbound redirect-follow requests from the application server to unusual ports on the same hostname.
• Logs: Application or proxy logs showing HTTP 302 redirect responses followed by credential-bearing requests to a different port or scheme on the same host; repeated redirect chains involving port changes (e.g., :443 → :8080) in access logs.
• Application Behavior: Unexpected authentication events or session activity on upstream services originating from IP addresses not associated with legitimate users, potentially indicating credential replay after capture.

Upgrade @hapi/wreck to version 18.1.2 or later, which replaces the hostname-only origin check with a full-origin comparison (scheme + host + port) (wreck v18.1.2 Release). If an immediate upgrade is not possible, two workarounds are available: (1) set redirects: 0 (the default) to disable automatic redirect following and handle redirects manually with a strict origin check; or (2) use the beforeRedirect hook to inspect the redirect target and explicitly strip sensitive headers or abort the request before following cross-origin redirects (GitHub Advisory).