CVE-2026-48615: Node.js Information Disclosure Vulnerability

CVE-2026-48615 Overview

CVE-2026-48615 is an information disclosure vulnerability in Node.js proxy tunnel error handling. When proxy credentials are embedded in the proxy URL, the runtime can leak those credentials through ERR_PROXY_TUNNEL error messages. Logs, diagnostic tools, and other error consumers may capture the credentials without the operator's knowledge.

The issue affects all supported Node.js release lines: Node.js 22, Node.js 24, and Node.js 26. The Node.js project classified this weakness under [CWE-359] (Exposure of Private Personal Information to an Unauthorized Actor). The flaw does not affect integrity or availability but exposes authentication material used to reach upstream services.

Critical Impact
Attackers or unauthorized log consumers can harvest proxy credentials from Node.js error output, enabling downstream compromise of proxied services.

Affected Products

Node.js 22.22.3 and earlier 22.x releases
Node.js 24.16.0 and earlier 24.x releases
Node.js 26.3.0 and earlier 26.x releases

Discovery Timeline

2026-06-26 - CVE-2026-48615 published to NVD
2026-06-26 - Last updated in NVD database
June 2026 - Node.js publishes coordinated security release addressing the issue

Technical Details for CVE-2026-48615

Vulnerability Analysis

The defect resides in the HTTP CONNECT proxy tunnel path used by Node.js when applications route outbound traffic through an authenticated proxy. When the tunnel setup fails, Node.js raises an ERR_PROXY_TUNNEL error. The error message includes the original proxy URL, and any userinfo component embedded in that URL is preserved verbatim.

Applications commonly configure proxies using URLs of the form http://user:password@proxy.example.com:8080. Once the error propagates, standard error handlers, telemetry pipelines, and log aggregators receive the message. The credentials then persist wherever those consumers store data. The vulnerability is remotely triggerable because an external network condition, such as an unreachable proxy or a rejected CONNECT request, is sufficient to generate the error.

Root Cause

The root cause is improper sanitization of sensitive URL components during error message construction. Node.js does not strip the userinfo segment before formatting the diagnostic string. This maps to [CWE-359] because private authentication material is exposed to unauthorized actors through a legitimate diagnostic channel.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An adversary who can influence proxy reachability, disrupt the CONNECT handshake, or read application logs and error telemetry can obtain the leaked credentials. Attackers with existing access to log storage, SIEM indices, crash reporters, or APM tools become the primary beneficiaries of the disclosure. See the Node.js June 2026 Security Releases advisory for protocol-level detail.

Detection Methods for CVE-2026-48615

Indicators of Compromise

Occurrences of the string ERR_PROXY_TUNNEL in application logs, especially entries containing @ characters that suggest embedded userinfo.
Log or telemetry records containing proxy URLs with credentials in the format scheme://user:password@host.
Unexpected authentication activity on upstream proxies traceable to credentials previously present only in Node.js configuration.

Detection Strategies

Grep centralized log stores for ERR_PROXY_TUNNEL combined with regex patterns matching credential-bearing URLs.
Add data loss prevention rules to SIEM ingestion pipelines that flag URL patterns containing userinfo components.
Inventory Node.js runtimes across the estate and compare installed versions against the fixed releases listed in the vendor advisory.

Monitoring Recommendations

Monitor outbound proxy authentication failures and correlate them with Node.js process error rates.
Track access to log repositories that historically ingested Node.js stderr or crash reports.
Rotate and alert on any proxy credentials that appeared in logs prior to remediation.

How to Mitigate CVE-2026-48615

Immediate Actions Required

Upgrade Node.js to the fixed releases published in the June 2026 security cycle for the 22.x, 24.x, and 26.x lines.
Rotate every proxy credential that was configured in a URL on a vulnerable Node.js runtime.
Purge or restrict access to historical logs containing ERR_PROXY_TUNNEL messages with embedded credentials.
Refactor application configuration to pass proxy credentials via headers or dedicated authentication fields rather than URL userinfo.

Patch Information

The Node.js project released fixed builds for all supported lines. Consult the Node.js June 2026 Security Releases advisory for the exact patched versions and download artifacts. Container images, CI runners, and serverless runtimes that bundle Node.js must be rebuilt against the patched binaries.

Workarounds

Store proxy credentials outside the URL, for example using Proxy-Authorization headers set explicitly by the application.
Wrap outbound HTTP client calls with error handlers that sanitize URL userinfo before logging.
Restrict log ingestion so that stderr output from Node.js processes is filtered through a redaction layer.

bash

# Configuration example: sanitize proxy URLs before use
# Split credentials out of HTTPS_PROXY and pass them via header instead
export PROXY_HOST="proxy.example.com:8080"
export PROXY_USER="svc-nodejs"
export PROXY_PASS="$(vault kv get -field=password secret/proxy)"
export HTTPS_PROXY="http://${PROXY_HOST}"
# Application code should set Proxy-Authorization: Basic base64(user:pass)