CVE-2026-48615

State: Published
Severity: 5.9 Medium
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: May 22, 2026

Description

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.

When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Scores

CVSS	Score	Vector	Source
3.0	5.9 Medium	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	hackerone

Weaknesses

CWE-359 Privacy Violation

Affected Products

Product	Versions
nodenodejs	22.22.3 through 22.22.3Affected 24.16.0 through 24.16.0Affected 26.3.0 through 26.3.0Affected

References

https://nodejs.org/en/blog/vulnerability/june-2026-security-releases

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.