hashi-vault-js CVE-2026-55102
MEDIUM
GHSA-5pq8-3ffp-7w5m
Severity by source
Log-read access (PR:L, AV:L) required to harvest the exposed token; no integrity or availability impact from the disclosure itself.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
Summary
Vault token and secret values are exposed in thrown errors when using hashi-vault-js.
Details
Every API method in Vault.js executes throw parseAxiosError(err), which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and the request body. Consuming applications that log caught errors (e.g., using console.error, pino, winston, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via err.config.data.
Impact
When consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance.
Patches
This vulnerability should be addressed by redacting err.config.headers['X-Vault-Token'] and err.config.data before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. Users should upgrade to a version that includes this fix.
Workarounds
If users cannot immediately update the library, they can mitigate this issue by capturing all exceptions thrown by hashi-vault-js and sanitizing or omitting the err.config object before passing the errors to logging utilities or crash reporters.
Acknowledgements
hashi-vault-js would like to thank Sebastián Alba Vives for reporting this vulnerability.
Resources
AnalysisAI
Credential exposure in hashi-vault-js (npm) leaks live HashiCorp Vault tokens and secret values into application logs and monitoring platforms via unredacted AxiosError objects. Every API method in the library re-throws the raw AxiosError, which carries the full Axios request configuration-including the X-Vault-Token authentication header and request body containing submitted passwords or secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is triggered when two conditions are met simultaneously: (1) the application uses any version of hashi-vault-js <= 0.5.1, and (2) at least one caught exception from the library is passed to any logging or error-reporting facility that serializes the error object (console.error, pino, winston, Sentry, Datadog APM, New Relic, or any APM SDK that captures exception context). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is elevated beyond what the absence of a CVSS score might imply: any Node.js service using hashi-vault-js that routes exceptions to a log aggregator or APM will silently persist live Vault tokens in its log storage indefinitely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade hashi-vault-js to version 0.5.2 or later, which addresses the issue by redacting err.config.headers['X-Vault-Token'] and err.config.data before re-throwing, or by throwing a purpose-built error containing only safe properties such as HTTP status and message. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Va
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. Rated cri
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, w
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows re
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today