CVE-2026-48615: High severity nodejs vulnerability
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure proxy credentials are not embedded in the proxy URL; supply proxy authentication credentials via safer mechanisms supported by your proxy/client configuration so they are not exposed in ERR_PROXY_TUNNEL error messages or downstream logs/diagnostics.
Node.js proxy tunneling (ERR_PROXY_TUNNEL) Avoid embedding proxy credentials in the proxy URL = Do not include username/password credentials in the proxy URL that the client passes to Node.js
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48615?
The severity of CVE-2026-48615 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-48615?
To mitigate CVE-2026-48615, ensure to sanitize proxy URLs to avoid exposing credentials and update to the latest Node.js version where the issue has been addressed.
What type of exposure risk is associated with CVE-2026-48615?
CVE-2026-48615 poses a risk of exposing sensitive proxy credentials through error messages that may be logged or retrievable by user actions.
In which version of Node.js does CVE-2026-48615 exist?
CVE-2026-48615 affects specific versions of Node.js prior to the updates that address this vulnerability.
What are the potential impacts of CVE-2026-48615?
The potential impact of CVE-2026-48615 includes unauthorized access to proxy credentials, which could lead to further exploitation of systems using that proxy.