{"action":"Upgrade @hapi/wreck to 18.1.2 or later.","affected":[{"fixed":"18.1.2","introduced":"0"}],"component":"@hapi/wreck","cve_ids":["CVE-2026-48022"],"ecosystem":"npm","epss":0.00176,"exploited":false,"fixed_versions":["18.1.2"],"ghsa_id":"GHSA-x426-x7cc-3fpc","id":"tcs_01M5KGGSE79ZBFQ4HPNBGBTW34","modified_at":"2026-09-10T03:50:51.210459476Z","published_at":"2026-06-11T13:27:05Z","references":["https://osv.dev/vulnerability/GHSA-x426-x7cc-3fpc","https://github.com/hapijs/wreck/security/advisories/GHSA-x426-x7cc-3fpc","https://github.com/hapijs/wreck/commit/b93323b63ad3adb14d2b4019d77219182211641e","https://github.com/hapijs/wreck"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-x426-x7cc-3fpc","url":"https://osv.dev/vulnerability/GHSA-x426-x7cc-3fpc"}],"summary":"@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects"}