The vulnerability occurs in @hapi/wreck, an HTTP client library. When it follows a 3xx redirect to a different hostname, the library strips only the Authorization and Cookie headers but fails to remove the Proxy‑Authorization header. Consequently, proxy credentials are forwarded to the redirect target, potentially leaking sensitive authentication information to an external host if redirects are enabled. The issue results in the disclosure of forward‑proxy credentials but does not allow code execution, escalation of privileges, or persistence.

The flaw affects all versions of hapijs:wreck older than 18.1.1 that are used in Node.js applications where redirects are enabled via the redirects option or Wreck.defaults({ redirects: ... }). Any deployment that employs the legacy 3xx redirect handling of this library is susceptible.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is less than 1 %, showing a very low likelihood of active exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The most plausible attack vector is a crafted request that triggers a cross‑hostname redirect, thereby leaking the Proxy‑Authorization header to the attacker’s controlled host. No privilege escalation or persistence is required; the impact is limited to credential disclosure.