GHSA-X426-X7CC-3FPC @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Impact Wreck strips credential headers Authorization, Cookie, Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port. As a result, credentials are forwarded intact across same-host port changes and HTTPS-to-HTTP...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +391 more potentially affected by CVE-2026-41721 via org.springframework.data:spring-data-commons (1.13.6.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +178 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.0.release)

org.springframework:spring-core MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overl...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

am.ik.blog:blog-domain (>=4.0.2, <=4.2.0), am.ik.blog:blog-mapper (>=4.0.0, <=4.4.0) +1806 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.7.release)

org.springframework:spring-core MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - am.ik.blog:blog-domain =4.0.2, =4.0.0, =2.0.0, =1.0.3, =1.0.0, =2.4, =2.4, =2.4, =2.4,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +159 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.3.1.release)

org.springframework:spring-webmvc MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =1.1.4-release, =1.1.4-release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +358 more potentially affected by CVE-2026-41848 via org.springframework:spring-core (4.3.1.release)

org.springframework:spring-core MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release, =1.1.0-releas...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +636 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.3.10.release)

org.springframework:spring-webmvc MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2026-41849 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +636 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.10.release)

org.springframework:spring-webmvc MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2026-41838 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.0), com.canoo.dolphin-platform:dolphin-platform-server-spring (>=0.6.1, <=0.8.6) +158 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.1.5.release)

org.springframework:spring-webmvc MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +26 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (4.3.0.release)

org.springframework:spring-webmvc MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...