Proxy Credentials Exposure in Node.js by Common Configuration Error
CVE-2026-123871

6.2MEDIUM

Key Information:

Vendor

Nodejs

Status
Node
Vendor
CVE Published:
11 November 2026

What is CVE-2026-123871?

Node.js has a vulnerability where the system unintentionally discloses proxy credentials in the ERR_PROXY_INVALID_CONFIG error messages. Despite a previous fix aiming to prevent proxy credentials from appearing, several error handling paths remain unsecured. This flaw allows sensitive information, which should be redacted, to be displayed in logs that can be accessed by a broader audience, potentially leading to unauthorized access. Affected versions include Node.js 22.x, 24.x, and 26.x.

Affected Version(s)

node 0.0.0 < 22.23.5

node 23.0.0 < 24.22.3

node 25.0.0 < 26.13.1

References

https://nodejs.org/en/blog/vulnerability/november-2026-se...
vendor-advisory
https://cna.openjsf.org/security-advisories.html

CVSS V3.0

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

p-v-p
mcollina
Trott
UlisesGascon
joyeecheung
aduh95
.