CVE-2026-48615: Proxy credentials leaked in ERR_PROXY_TUNNEL error message
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Other sources
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
— Node.Js
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0Fixed in 24.17.0Fixed in 26.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 22.23.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 24.17.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.3.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-48615?
The severity of CVE-2026-48615 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-48615?
To mitigate CVE-2026-48615, ensure to sanitize proxy URLs to avoid exposing credentials and update to the latest Node.js version where the issue has been addressed.
What type of exposure risk is associated with CVE-2026-48615?
CVE-2026-48615 poses a risk of exposing sensitive proxy credentials through error messages that may be logged or retrievable by user actions.
In which version of Node.js does CVE-2026-48615 exist?
CVE-2026-48615 affects specific versions of Node.js prior to the updates that address this vulnerability.
What are the potential impacts of CVE-2026-48615?
The potential impact of CVE-2026-48615 includes unauthorized access to proxy credentials, which could lead to further exploitation of systems using that proxy.