Executive brief
Node.js is a popular environment for running web applications and server-side code. A flaw in how it handles errors when connecting through a proxy server could cause sensitive login credentials to be included in error messages. If these errors are recorded in system logs or displayed to users, an attacker could potentially gain access to the proxy credentials, compromising the security of the network connection.
Technical details
A vulnerability exists in Node.js where proxy credentials embedded in a proxy URL may be leaked through the ERR_PROXY_TUNNEL error message. When a connection through a proxy tunnel fails, the error handling path fails to sanitize the proxy URL, potentially exposing sensitive authentication information to logs, diagnostics, or other error consumers. This is classified as an information exposure vulnerability (CWE-359). The attack vector is network-based but requires a high complexity (AC:H) as it depends on specific error conditions occurring while using embedded credentials. Patches have been released in Node.js versions 22.23.0, 24.17.0, and 26.3.1.
Affected products
- Node.js Node.js 22.x < 22.23.0, 24.x < 24.17.0, 26.x < 26.3.1
Timeline
- 2026-06-18: patched: Security releases 22.23.0, 24.17.0, and 26.3.1 made available.
- 2026-06-26: disclosed: NVD publication date.