{"action":"Upgrade @hapi/wreck to 18.1.1 or later.","affected":[{"fixed":"18.1.1","introduced":"0"}],"component":"@hapi/wreck","cve_ids":["CVE-2026-44979"],"ecosystem":"npm","epss":0.0042,"exploited":false,"fixed_versions":["18.1.1"],"ghsa_id":"GHSA-vhjm-w67q-g75c","id":"tcs_01M5KGC14Z5FZSZVQGDP0SZCKT","modified_at":"2026-09-10T03:50:47.710849639Z","published_at":"2026-05-27T00:38:09Z","references":["https://osv.dev/vulnerability/GHSA-vhjm-w67q-g75c","https://github.com/hapijs/wreck/security/advisories/GHSA-vhjm-w67q-g75c","https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3","https://github.com/hapijs/wreck/commit/a5b6fac9c684621c1d5733d10a0257697cfea373","https://github.com/hapijs/wreck"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vhjm-w67q-g75c","url":"https://osv.dev/vulnerability/GHSA-vhjm-w67q-g75c"}],"summary":"@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects"}