Node.js: Proxy credential disclosure in ERR_PROXY_INVALID_CONFIG error messages
Summary
Node.js discloses proxy credentials (username and password) in ERR_PROXY_INVALID_CONFIG error messages on four code paths that an earlier fix for CVE-2026-48615 missed. An attacker with local read access to logs, stderr, container output, log aggregation or crash reporting data can obtain these credentials. The proxy URL must contain embedded credentials and the error must be logged or reported for the leak to occur.
Affected
- Node.js 22.x before 22.23.5
- Node.js 24.x before 24.22.3
- Node.js 26.x before 26.13.1
- Node.js 23.x and 25.x (end-of-life lines, always affected when a security release ships)
Fixed in
- Upgrade to Node.js 22.23.5, 24.22.3 or 26.13.1 (or later)
- Move to a supported Node.js line if running 23.x or 25.x
Workaround
Unknown.
- Until patched, avoid embedding credentials in proxy URLs where possible.
- Restrict access to application logs, stderr and crash reporting data.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- Not listed in CISA KEV as far as checked.
Our recommendation
- Patch Node.js to 22.23.5, 24.22.3 or 26.13.1 in the November 2026 release cycle, and retire 23.x and 25.x runtimes.
- Find applications that use proxy URLs with embedded credentials and move the credentials to environment variables or a secret store.
- If logs or crash reports may contain a proxy URL, rotate the affected proxy credentials.
- Limit who can read logs and crash reporting data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OpenJS CNA security advisories cna.openjsf.org
- Node.js November 2026 security releases nodejs.org
- Node.js 26.13.1 release nodejs.org
- VulDB CVE-2026-123871 vuldb.com
- CVE-2026-123871 CVE record summary cve.threatint.com
- OffSeq CVE-2026-123871 radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:41.
Original description (NVD)
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.