SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-44979

MEDIUM · CVSS 6.3 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The @hapi/wreck HTTP client utility prior to version 18.1.1 is vulnerable to improper handling of 3xx redirects, where the Proxy-Authorization header is forwarded to a different hostname, potentially exposing sensitive forward-proxy credentials. This vulnerability could lead to credential leakage outside the intended trust boundary, making it critical for developers and organizations using this library to upgrade to version 18.1.1 or later to mitigate the risk. Prioritization is essential for those who have enabled redirects in their configurations.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-44979
Severity
MEDIUM
CVSS
6.3
EPSS
0.26%

Original NVD Description

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.