Node.js Proxy Tunnel Error Handling Flaw Exposes Credentials

CVE-2026-48615

What is CVE-2026-48615?

A security flaw in the error handling mechanism of Node.js proxy tunnels could unintentionally expose sensitive proxy credentials. When credentials are integrated into the proxy URL, they can be made visible through the 'ERR_PROXY_TUNNEL' error messages. This exposure may lead to unauthorized access if the credentials are logged or mishandled during diagnostics or error reporting. This issue affects all current supported versions of Node.js, specifically the 22, 24, and 26 release lines, posing a risk to users relying on these versions.

References