Skip to main content

Node.js CVE-2026-48615

| EUVDEUVD-2026-39606 HIGH
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2026-06-18 GHSA-qqjm-7pv6-7q82
Information Disclosure Node Js Red Hat Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
3.7 LOW

AC:H because exploitation needs a triggered tunnel error plus attacker visibility into the error/log; C:L as only proxy credentials leak, with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

9
Analysis Updated
Jun 26, 2026 - 20:35 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 26, 2026 - 20:34 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 26, 2026 - 20:22 vuln.today
cvss_changed
Severity Changed
Jun 26, 2026 - 20:22 NVD
MEDIUM HIGH
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Source Code Evidence Fetched
Jun 26, 2026 - 02:24 vuln.today
Analysis Generated
Jun 26, 2026 - 02:24 vuln.today
CVSS changed
Jun 26, 2026 - 02:22 NVD
5.9 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

AnalysisAI

Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials when a CONNECT tunnel connection fails, because the full proxy URL - including username and password - is included verbatim in the resulting tunnel error message rather than being redacted. Anyone able to read those error strings (application logs, error responses, monitoring/telemetry pipelines) can recover the proxy authentication secret. This is a Medium-rated, post-disclosure security-release fix (fixed in v26.3.1); there is no public exploit identified at time of analysis and EPSS is low at 0.38% (30th percentile).

Technical ContextAI

The flaw lives in Node.js's built-in HTTP/HTTPS proxy tunneling support, where outbound requests are routed through a proxy using the HTTP CONNECT method and credentials are supplied inline in the proxy URL (e.g. http://user:pass@proxy:8080). When the tunnel handshake fails, Node constructs an error describing the failed connection and historically embedded the originating proxy URL with credentials intact. CPE data confirms the affected component is cpe:2.3:a:nodejs:node.js across the 22.x, 24.x, and 26.x release lines. The root cause maps to CWE-359 (Exposure of Private Personal Information / sensitive information to an unauthorized actor): a secret is propagated into a diagnostic surface that was never intended to carry it. The fix ('lib,test: redact proxy credentials in tunnel errors') masks the userinfo portion of the URL before it reaches the error object.

RemediationAI

Primary fix: upgrade to Node.js 26.3.1 or later (Vendor-released patch: Node.js 26.3.1), and on the LTS lines move to the corresponding patched 24.x and 22.x builds from the June 2026 security release - see https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. If immediate upgrade is not possible, the most effective compensating control is to stop embedding credentials in proxy URLs: supply proxy authentication via a Proxy-Authorization header set per-request instead of user:pass@host, so no secret exists in the URL that could be echoed into an error (trade-off: requires application code changes and may not be supported by all HTTP clients). Additionally, scrub or suppress tunnel/connection error strings before they are logged or returned to clients - e.g. catch proxy connection errors and emit a generic message - and audit existing log stores and error-telemetry pipelines for already-leaked credentials, rotating any proxy passwords found (trade-off: reduced diagnostic detail for operators). Avoid forwarding raw Node error objects to end users.

More in Node Js

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

CVE-2022-3602 HIGH
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
CVE-2015-3194 HIGH
7.5 Dec 06

crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial

CVE-2016-2105 HIGH
7.5 May 05

Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2
CVE-2022-3786 HIGH POC
7.5 Nov 01

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
CVE-2024-3566 CRITICAL POC
9.8 Apr 10

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
CVE-2022-0778 HIGH POC
7.5 Mar 15

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

View all
CVE-2024-11396 MEDIUM POC
5.3
CVE-2022-0482 CRITICAL POC
9.1
CVE-2025-54125 HIGH POC
8.7
CVE-2022-2921 HIGH POC
8.8
CVE-2019-25762 HIGH POC
8.7
CVE-2024-10267 HIGH POC
7.5
CVE-2020-37173 HIGH POC
7.5
CVE-2025-65857 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-48615 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy