@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-48022 · Microsoft / collected KEV context

GHSA-x426-x7cc-3fpc

cve-program · CVE-2026-48022

• https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc
• https://github.com/hapijs/wreck/pull/313
• https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e
• https://github.com/hapijs/wreck/releases/tag/v18.1.2

nvd · CVE-2026-48022

• https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e
• https://github.com/hapijs/wreck/pull/313
• https://github.com/hapijs/wreck/releases/tag/v18.1.2
• https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc

osv · GHSA-x426-x7cc-3fpc

• https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc
• https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e
• https://github.com/hapijs/wreck

No related operational record is retained in the current change model.