GHSA-5pq8-3ffp-7w5m: Npm/hashi-vault-js vulnerability
Summary
Vault token and secret values are exposed in thrown errors when using hashi-vault-js.
Details
Every API method in Vault.js executes throw parseAxiosError(err), which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and the request body. Consuming applications that log caught errors (e.g., using console.error, pino, winston, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via err.config.data.
Impact
When consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance.
Patches
This vulnerability should be addressed by redacting err.config.headers['X-Vault-Token'] and err.config.data before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. Users should upgrade to a version that includes this fix.
Workarounds
If users cannot immediately update the library, they can mitigate this issue by capturing all exceptions thrown by hashi-vault-js and sanitizing or omitting the err.config object before passing the errors to logging utilities or crash reporters.
Acknowledgements hashi-vault-js would like to thank Sebastián Alba Vives for reporting this vulnerability.
Resources
- CWE-532: Insertion of Sensitive Information into Log File - CWE-209: Generation of Error Message Containing Sensitive Information
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/hashi-vault-jsto a version that resolves this vulnerability.Fixed in 0.5.2 - Configuration
Wrap calls to hashi-vault-js and capture exceptions; before sending any error to console/error loggers (e.g., console.error, pino, winston, Sentry/APM), sanitize the caught error by redacting err.config.headers['X-Vault-Token'] and omitting err.config.data, or re-throw a purpose-built error containing only safe properties such as status and message.
Consuming application (error handling around hashi-vault-js exceptions) Sanitize/omit AxiosError.config before logging = Redact err.config.headers['X-Vault-Token'] and remove err.config.data from thrown errors before passing to logging/crash reporters
Event History
Frequently Asked Questions
What is the severity of GHSA-5pq8-3ffp-7w5m?
The severity of GHSA-5pq8-3ffp-7w5m is rated at 62, indicating a medium risk.
What vulnerabilities are associated with GHSA-5pq8-3ffp-7w5m?
GHSA-5pq8-3ffp-7w5m exposes Vault token and secret values through unhandled Axios errors.
How do I fix GHSA-5pq8-3ffp-7w5m?
To fix GHSA-5pq8-3ffp-7w5m, ensure proper error handling to prevent sensitive information from being exposed.
Which software is affected by GHSA-5pq8-3ffp-7w5m?
The affected software is the npm package 'hashi-vault-js'.
What should developers do in response to GHSA-5pq8-3ffp-7w5m?
Developers should review their error handling practices and consider updating the 'hashi-vault-js' package.