UBUNTU-CVE-2026-123871: Medium severity ubuntu/nodejs vulnerability
Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERRPROXYINVALIDCONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to credential disclosure?
Node.js 22.x, 24.x, and 26.x processes are affected when their environment supplies a proxy URL containing credentials and an invalid proxy configuration reaches one of the vulnerable error paths. Credentials may then be exposed through stderr, container logs, log aggregation, or crash-reporting services.
What must occur for credentials to be disclosed?
The process must use a proxy URL from its environment that includes a username or password, and Node.js must generate an ERR_PROXY_INVALID_CONFIG error through one of the missed error paths. The raw proxy URL can be interpolated into that error message.
How can teams check for prior exposure?
Review stderr, container logs, centralized logging, and crash-reporting records for ERR_PROXY_INVALID_CONFIG messages. Such messages may contain a proxy URL with credentials in clear text.