CVE-2026-48615CWE-359

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages

Medium · published June 26, 2026

CVSS v3.0
5.9
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.

When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2026-06-26T01:14Z
EPSS history
Timeline
  • 26 JUN 01:14Z
    A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages
    cvelistv5