DEBIAN-CVE-2026-123871: Medium severity debian/nodejs vulnerability

Published Nov 11, 2026

Updated

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERRPROXYINVALIDCONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Affected Software

3 affected components

debian/nodejs*

Event History

Nov 11, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are most exposed to credential disclosure?

Deployments running affected Node.js 22.x, 24.x, or 26.x are exposed when a proxy URL containing a username or password is supplied through the environment and an ERR_PROXY_INVALID_CONFIG error is produced. The greatest downstream exposure is where stderr is collected by container logging, log aggregation, or crash-reporting services.

What must occur for credentials to be leaked?

A raw proxy URL with embedded credentials must reach one of the unredacted invalid-proxy-configuration error paths. Those paths interpolate the full proxy URL into ERR_PROXY_INVALID_CONFIG, rather than using the redacted ProxyConfig.href value.

How can I determine whether credentials may already have been exposed?

Review stderr, container logs, centralized log stores, and crash-reporting records for ERR_PROXY_INVALID_CONFIG messages from affected Node.js releases. An affected message can contain the proxy URL verbatim, including its username and password.

DEBIAN-CVE-2026-123871: Medium severity debian/nodejs vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed to credential disclosure?

What must occur for credentials to be leaked?

How can I determine whether credentials may already have been exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to credential disclosure?

What must occur for credentials to be leaked?

How can I determine whether credentials may already have been exposed?