CVE-2026-48615
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
| CWE | CWE-359 |
| Vendor | nodejs |
| Product | node |
| Ecosystems | |
| Industries | Technology |
| Published | Jun 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for nodejs node
Be the first to know when new medium vulnerabilities affecting nodejs node are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Versions
nodejs / node
22.22.3 ≤ 22.22.3 24.16.0 ≤ 24.16.0 26.3.0 ≤ 26.3.0