Executive brief
hashi-vault-js is a JavaScript library for interacting with HashiCorp Vault, a secrets management tool used to protect sensitive credentials in organizations. When errors occur during API calls, the library throws unfiltered error objects that contain authentication tokens and secret values in plaintext. Applications that log these errors—which is standard practice for debugging and monitoring—unknowingly expose live Vault tokens and passwords to their logging systems, crash reporters, and APM platforms. An attacker with access to logs could gain unauthorized access to the Vault instance and steal all stored secrets.
Technical details
The vulnerability is a sensitive information disclosure issue (CWE-209, CWE-532) in the error handling path of hashi-vault-js. Every API method in Vault.js calls `throw parseAxiosError(err)`, which returns the raw AxiosError object untouched, including the full Axios configuration object. This configuration carries the `X-Vault-Token` header (the authentication token for the Vault instance) and the request body (which may contain passwords or secrets on write operations). When consuming applications catch and log these exceptions using standard logging libraries (console.error, pino, winston) or crash reporting services (Sentry, APM platforms), the sensitive credentials are written to logs in plaintext. An attacker with log access can extract the token and authenticate directly to Vault. The fix involves redacting or filtering `err.config.headers['X-Vault-Token']` and `err.config.data` before re-throwing the error. Patched version 0.5.2 is available; versions <= 0.5.1 are vulnerable. No CVSS score is provided in the advisory.
Affected products
- Kyndryl hashi-vault-js <= 0.5.1
Timeline
- 2026-06-10: disclosed: Initially published to GitHub Advisory Database
- 2026-08-13: patched: Patched version 0.5.2 released; advisory updated