Описание
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.
Отчет
This Moderate-impact information disclosure flaw in Node.js allows proxy credentials to be exposed in ERR_PROXY_TUNNEL error messages. In Red Hat environments, if Node.js applications are configured to embed proxy credentials directly within the proxy URL, these sensitive details could be inadvertently captured by system logs or other error monitoring tools during proxy tunnel error handling.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nodejs26 | Affected | ||
| Red Hat Enterprise Linux 9 | nodejs:26/nodejs | Affected | ||
| Red Hat Enterprise Linux 10 | nodejs24 | Fixed | RHSA-2026:35841 | 06.07.2026 |
| Red Hat Enterprise Linux 10 | nodejs22 | Fixed | RHSA-2026:35842 | 06.07.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | nodejs22 | Fixed | RHSA-2026:39246 | 14.07.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:39868 | 15.07.2026 |
| Red Hat Enterprise Linux 8 | nodejs | Fixed | RHSA-2026:41947 | 20.07.2026 |
| Red Hat Enterprise Linux 9 | nodejs | Fixed | RHSA-2026:35891 | 06.07.2026 |
| Red Hat Enterprise Linux 9 | nodejs | Fixed | RHSA-2026:35892 | 06.07.2026 |
| Red Hat Enterprise Linux 9.6 Extended Update Support | nodejs | Fixed | RHSA-2026:52399 | 10.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
A flaw in Node.js proxy tunnel error handling could expose proxy crede ...
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
EPSS
5.9 Medium
CVSS3