Skip to main content

Node.js CVE-2026-48615

| EUVDEUVD-2026-39606 HIGH
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2026-06-18 GHSA-qqjm-7pv6-7q82
Information Disclosure Node.js Red Hat Suse Node Js
7.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Node app using authenticated proxy
  2. Delivery
    Induce or await tunnel connection failure
  3. Exploit
    Proxy URL with credentials embedded in error
  4. Execution
    Read error from logs or response
  5. Impact
    Harvest and reuse proxy credentials

Vulnerability Assessment

Weakness
CWE
CWE-359
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
Exploitation Conditions

Exploitation requires that the Node.js application uses proxy tunneling (HTTP CONNECT) with credentials embedded in the proxy URL, AND that a tunnel connection error occurs, AND that the attacker can read the resulting error message - via application logs, monitoring/telemetry export, or an error returned to the client. Limiting factors: if no credentials are embedded in the proxy configuration there is nothing to leak; if proxy connections never fail no error is generated; and the attacker must have a path to observe the error string rather than direct network read access. Despite the CVSS PR:N/UI:N rating, real-world exploitation is gated by the credential-in-URL configuration and by error-message visibility, so it is not reliable against arbitrary default deployments.
Impact

Signals are mixed and point to a real-but-modest priority. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) treats this as a network-reachable, no-privilege, high-confidentiality issue, but that scoring is generous for a credential-leak-via-error: in practice an attacker does not directly read memory over the network - they must trigger or observe a tunnel error and then read the resulting message/log, which is closer to AC:H and a narrower confidentiality impact (proxy credentials only, not C:H of the whole system). The independent signals reinforce lower urgency: EPSS is 0.38% (30th percentile), there is no CISA KEV listing, and no public exploit code is identified. There is a genuine tension worth flagging: CVSS asserts AV:N/C:H, but the description ('redact proxy credentials in tunnel errors') implies the disclosure channel is an error string/log, so exploitation realistically depends on the attacker having visibility into Node's error output - verify against your own logging/error-surfacing posture. Net: patch in normal cadence; treat as elevated only if proxy errors are exposed to untrusted parties or shipped to third-party log sinks.
Exploit ScenarioDerived

An application routes outbound traffic through an authenticated proxy configured as http://svc:S3cret@proxy:8080. An attacker who can cause the tunnel to fail (e.g. by making the app reach an unreachable upstream) or who can read the application's error logs or returned error responses observes the unredacted proxy URL in the tunnel error message and harvests the proxy credentials. No public exploit code is identified at time of analysis; exploitation is opportunistic and depends on the attacker's ability to view the error output.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 26, 2026

Sensitive information disclosure in Node.js (versions 26.3.0, 24.16.0, and 22.22.3) leaks embedded proxy credentials when a CONNECT tunnel connection fails, because the full proxy URL - including username and password - is included verbatim in the resulting tunnel error message rather than being redacted. Anyone able to read those error strings (application logs, error responses, monitoring/telemetry pipelines) can recover the proxy authentication secret. This is a Medium-rated, post-disclosure security-release fix (fixed in v26.3.1); there is no public exploit identified at time of analysis and EPSS is low at 0.38% (30th percentile).

Earlier versions of this analysis (2)
v2 Jun 26, 2026 - 20:34 cvss changed CVSS 7.5

Sensitive information disclosure in Node.js (fixed in 26.3.1) leaks embedded proxy credentials when an HTTP CONNECT tunnel fails: error objects raised during proxy tunnel setup include the username and password from the proxy URL rather than redacting them. The flaw affects Node 26.3.0, 24.16.0 and 22.22.3 and is corrected by the 'lib,test: redact proxy credentials in tunnel errors' change shipped in the June 2026 security release. It is rated Medium by the project (NVD CVSS 7.5); no public exploit identified at time of analysis and it is not listed in CISA KEV, with an EPSS of 0.38% (30th percentile).

v1 Jun 26, 2026 - 02:24 CVSS 5.9

Proxy credential exposure in Node.js HTTP tunneling leaks embedded proxy authentication credentials (username and password) through error messages when an HTTP CONNECT tunnel fails. Applications running on Node.js prior to v26.3.1 that route traffic through authenticated HTTP proxies using credential-embedded URLs are affected. An actor with access to application error output - logs, crash reports, or monitoring dashboards - can recover proxy credentials and use them to authenticate to the proxy independently, enabling lateral movement into protected network segments. No public exploit or CISA KEV listing has been identified; vendor-released patch is confirmed at v26.3.1.

RemediationAI

Primary fix: upgrade to Node.js 26.3.1 or later (Vendor-released patch: Node.js 26.3.1), and on the LTS lines move to the corresponding patched 24.x and 22.x builds from the June 2026 security release - see https://github.com/nodejs/node/releases/tag/v26.3.1 and https://nodejs.org/en/blog/vulnerability/june-2026-security-releases. If immediate upgrade is not possible, the most effective compensating control is to stop embedding credentials in proxy URLs: supply proxy authentication via a Proxy-Authorization header set per-request instead of user:pass@host, so no secret exists in the URL that could be echoed into an error (trade-off: requires application code changes and may not be supported by all HTTP clients). Additionally, scrub or suppress tunnel/connection error strings before they are logged or returned to clients - e.g. catch proxy connection errors and emit a generic message - and audit existing log stores and error-telemetry pipelines for already-leaked credentials, rotating any proxy passwords found (trade-off: reduced diagnostic detail for operators). Avoid forwarding raw Node error objects to end users.

Affected VersionsENISA

Node 26.3.0 ≤26.3.0
Node 22.22.3 ≤22.22.3
Node 24.16.0 ≤24.16.0

Affected Packages

euvd node no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in Node.js's built-in HTTP/HTTPS proxy tunneling support, where outbound requests are routed through a proxy using the HTTP CONNECT method and credentials are supplied inline in the proxy URL (e.g. http://user:pass@proxy:8080). When the tunnel handshake fails, Node constructs an error describing the failed connection and historically embedded the originating proxy URL with credentials intact. CPE data confirms the affected component is cpe:2.3:a:nodejs:node.js across the 22.x, 24.x, and 26.x release lines. The root cause maps to CWE-359 (Exposure of Private Personal Information / sensitive information to an unauthorized actor): a secret is propagated into a diagnostic surface that was never intended to carry it. The fix ('lib,test: redact proxy credentials in tunnel errors') masks the userinfo portion of the URL before it reaches the error object.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 3.7 LOW

AC:H because exploitation needs a triggered tunnel error plus attacker visibility into the error/log; C:L as only proxy credentials leak, with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.9 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 26, 2026 - 20:22 NVD
MEDIUM HIGH
CVSS changed
Jun 26, 2026 - 20:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
CVSS changed
Jun 26, 2026 - 02:22 NVD
5.9 (MEDIUM)
CVE Published
Jun 18, 2026 - 04:37 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of nodejs/node. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Node.js versions 26.3.0, 24.16.0, and 22.22.3 leak authentication credentials for proxy servers in application error messages and logs, creating potential unauthorized access to network infrastructure. Organizations using these versions should prioritize urgent patching to prevent credential theft and unwanted network access.

Business Impact: High
Compensating Controls

Apply vendor patch (v26.3.1 or later for v26.x). Interim mitigations if patching is delayed: restrict access to application logs and error output; implement log redaction for proxy-related error messages; rotate proxy credentials proactively.

Threat Intelligence Overview

EPSS Score
0.4%
Top 70% exploitable
Prevalence
Ubiquitous
Node.js is a core runtime across web, cloud, and CI environments worldwide
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

View all
CVE-2024-11396 MEDIUM POC
5.3
CVE-2022-0482 CRITICAL POC
9.1
CVE-2025-54125 HIGH POC
8.7
CVE-2022-2921 HIGH POC
8.8
CVE-2019-25762 HIGH POC
8.7
CVE-2025-62644 HIGH POC
7.7
CVE-2024-10267 HIGH POC
7.5
CVE-2020-37173 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:28727 ADVISORY https://access.redhat.com/errata/RHSA-2026:29012 ADVISORY https://access.redhat.com/errata/RHSA-2026:30172 ADVISORY https://access.redhat.com/errata/RHSA-2026:7378 ADVISORY https://access.redhat.com/errata/RHSA-2026:9455 ADVISORY https://github.com/nodejs/node/releases/tag/v26.3.1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-48615 ADVISORY https://seclists.org/oss-sec/2026/q2/984 ADVISORY https://vuldb.com/vuln/374099 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2647/ REF https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy