CVE-2026-44979

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44979
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44979.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-44979
Aliases
Downstream
CGA (72)
CLEANSTART (3)
CLSA (1)
MINI (15)
ROOT (1)
Published
2026-07-17T21:01:01Z
Modified
2026-10-26T02:34:10Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
@hapi/wreck : Sensitive `Proxy-Authorization` header leaked across cross-hostname redirects
Details

@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-522"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44979.json"
}
References

Affected packages

Git / github.com/hapijs/wreck

Affected ranges

Type
GIT
Repo
https://github.com/hapijs/wreck
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ffeabc4cf97003a0717e41910c4698479b4bbed8
Fixed
a5b6fac9c684621c1d5733d10a0257697cfea373
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "18.1.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a5b6fac9c684621c1d5733d10a0257697cfea373"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v18.1.1",
            "range": [
                {
                    "fixed": "ffeabc4cf97003a0717e41910c4698479b4bbed8"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v1.*
v1.0.0
v10.*
v10.0.0
v11.*
v11.0.0
v12.*
v12.0.0
v12.1.0
v12.2.0
v12.2.1
v12.2.2
v12.2.3
v12.3.0
v12.4.0
v12.5.0
v13.*
v13.0.0
v13.0.1
v13.0.3
v14.*
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.2
v14.1.3
v14.1.4
v14.2.0
v15.*
v15.0.0
v15.0.1
v15.0.2
v15.1.0
v16.*
v16.0.0
v16.0.1
v17.*
v17.0.0
v17.1.0
v17.2.0
v18.*
v18.0.0
v18.0.1
v18.0.2
v18.1.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v3.*
v3.0.0
v4.*
v4.0.0
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.2.0
v5.3.0
v5.4.0
v5.5.0
v5.5.1
v5.6.0
v5.6.1
v6.*
v6.0.0
v6.1.0
v6.2.0
v6.3.0
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.1.0
v7.2.0
v7.2.1
v8.*
v8.0.0
v8.0.1
v9.*
v9.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44979.json"