Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-17 | 2 | General1Patch1 |
| 2026-07-18 | 1 | Disclosure1 |
CVE-2026-44979 Proxy-Authorization Header Exposure in @hapi/wreck Before 18.1.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44979
Post summary
The brief notice notes a Proxy‑Authorization header exposure vulnerability in @hapi/wreck before version 18.1.1 and includes a link to a vulnerability detail page.
🚨*CVE* CVE-2026-44979 @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are… https://www.cve.org/CVERecord?id=CVE-2026-44979 ----- Traducción: CVE-2026-44979 @ha… http://infoflow.cloud`
Post summary
The text identifies CVE‑2026‑44979, noting an issue where @hapi/wreck leaks auth/cookie headers on cross‑host redirects, but offers no proof of exploitation, tool, or patch.
CVE-2026-44979 @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are… https://www.cve.org/CVERecord?id=CVE-2026-44979
Post summary
The post notes that @hapi/wreck versions before 18.1.1 mishandle Authorization and Cookie headers on 3xx redirects to other hostnames, with the issue supposedly fixed in 18.1.1; no PoC or active exploitation is mentioned.