Skip to content

fix(deps): update dependency @hapi/wreck to v18.1.2 [security] - #537

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-hapi-wreck-vulnerability
Closed

fix(deps): update dependency @hapi/wreck to v18.1.2 [security]#537
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-hapi-wreck-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@hapi/wreck 18.0.0 → 18.1.2 age confidence

@​hapi/wreck leaks sensitive Proxy-Authorization header across cross-hostname redirects

CVE-2026-44979 / GHSA-vhjm-w67q-g75c

More information

Details

Impact

When @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped. The standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary.

Redirect following is opt-in. The redirects option defaults to false (no redirections followed), so applications are only affected if they have explicitly set redirects to a positive integer on the request or via Wreck.defaults({ redirects: ... }).

Patches

@hapi/wreck 18.1.1 extends the cross-hostname strip set to include proxy-authorization. Upgrade to 18.1.1 or later.

Workarounds

If upgrading is not immediately possible:

  • Leave redirects at its default (false) — applications that never enable redirect following are not affected.
  • If redirects are required, set redirects: 0 when calling endpoints with sensitive headers, or strip Proxy-Authorization from the headers before issuing the request.
  • Use the beforeRedirect hook to manually strip proxy-authorization (and any other sensitive application headers) when redirectOptions targets a different hostname than the original request.
Resources

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

CVE-2026-48022 / GHSA-x426-x7cc-3fpc

More information

Details

Impact

Wreck strips credential headers (Authorization, Cookie, Proxy-Authorization) before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP downgrades, allowing a co-tenant on an adjacent port or a network-position attacker capable of forging a redirect to capture bearer tokens, session cookies, and proxy credentials and impersonate the victim against the upstream service. The fix replaces the hostname comparison with a full-origin comparison (scheme, host, and port), aligning the behavior with the WHATWG Fetch same-origin definition used by browsers.

Patches

Upgrade to >= 18.1.2.

Workarounds
  • Set redirects: 0 (default) and handle redirects manually with a strict origin check.
  • Use the beforeRedirect hook to inspect the redirect target and abort or strip sensitive headers before the follow-on request.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

hapijs/wreck (@​hapi/wreck)

v18.1.2

Compare Source

v18.1.1

Compare Source

v18.1.0

Compare Source

v18.0.2

Compare Source

v18.0.1

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 27, 2026
@renovate
renovate Bot requested a review from a team as a code owner August 27, 2026 22:46
@renovate
renovate Bot enabled auto-merge (squash) August 27, 2026 22:46
@shcheklein shcheklein mentioned this pull request Oct 21, 2026
Merged
shcheklein added a commit that referenced this pull request Oct 21, 2026
@shcheklein @claude
chore(deps): consolidate dependency updates (#542)
e44442a 
Direct dependencies (exact pins):
- compression 1.7.4 -> 1.8.2 (#540)
- moment 2.29.4 -> 2.31.0 (#539)
- @hapi/wreck 18.0.0 -> 18.1.2 (#537)
- @babel/core 7.20.12 -> 7.29.7 (#536; latest 7.x, includes the 7.29.6 fix)
- lodash 4.17.21 -> 4.18.1 (#531; supersedes #530)
- nanoid ^4.0.0 -> 5.1.16 (#515; now pinned; not imported by site code,
  the theme already uses nanoid 5)
- @svgr/webpack 6.5.1 -> 8.1.0 (#513; the theme's gatsby-plugin-svgr
  already compiled SVGs with 8.1.0)

Transitive (yarn up -R, lockfile only):
- axios 1.12.1 -> 1.20.0 (#534)
- tar 7.4.3 -> 7.5.22 (#532)
- diff 5.1.0 -> 5.2.2 (#528)
- @smithy/config-resolver 4.1.0 -> 4.7.2 (#526)
- express 4.18.2 -> 4.22.3 (#525); express 5 (websites-server) 5.1.0 -> 5.2.1
- js-yaml 3.14.1 -> 3.15.2 (#523); 4.1.0 -> 4.3.2
- tar-fs 2.1.1 -> 2.1.5 (#522); 3.0.4 -> 3.1.3
- brace-expansion 1.1.11 -> 1.1.21 (#520); 2.0.1 -> 2.1.7
- @babel/helpers -> 7.29.10 (#519)
- prismjs 1.29.0 -> 1.30.0 (#517)
- cross-spawn 6.0.5 -> 6.0.6 (#516); 7.0.3 -> 7.0.6
- @babel/runtime -> 7.29.10 (#514)

Lockfile-only pins (yarn set resolution, no package.json resolutions) to
avoid releases younger than 14 days: express@^5.1.0 -> 5.2.1,
@smithy/core@^3.33.2 -> 3.35.1, qs -> 6.16.0, bare-fs -> 4.8.2,
bare-url -> 2.5.4.

Skipped:
- eslint 8 -> 9 (#533): needs a flat-config migration, and
  @typescript-eslint v5, eslint-plugin-react 7.32 and eslint-plugin-jsx-a11y
  6.7 only support eslint <= 8.

Verified locally on Node 22.19.0: yarn install --immutable, build, lint,
lint-ts, lint-css, test, format-check-all, and the production server
(/, /doc, /doc/ref/comment). Rendered HTML is unchanged apart from asset
hashes.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@shcheklein

shcheklein commented Oct 21, 2026

Copy link
Copy Markdown
Member

Superseded by #542, which applies this update (or a newer version) together with the other dependency updates, verified locally.

@shcheklein shcheklein closed this Oct 21, 2026
auto-merge was automatically disabled October 21, 2026 22:45

Pull request was closed

@renovate
renovate Bot deleted the renovate/npm-hapi-wreck-vulnerability branch October 21, 2026 22:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shcheklein