CVE-2026-55100 Overview
CVE-2026-55100 affects hashi-vault-js, a Node.js module for interacting with the HashiCorp Vault API. Versions prior to 0.5.2 concatenate unencoded identifier values directly into Vault request paths and query strings. The affected identifiers include name, username, group, role, and version. Because the library skips encodeURIComponent() and URLSearchParams, attacker-controlled input can escape the intended path segment. This enables path traversal and query parameter injection against the upstream Vault API. The maintainers fixed the issue in version 0.5.2. The vulnerability is categorized under [CWE-23] Relative Path Traversal.
Critical Impact
Unencoded identifiers passed to src/Vault.js allow attackers to manipulate Vault request paths, potentially accessing unauthorized secrets or altering intended API operations.
Affected Products
- hashi-vault-js versions prior to 0.5.2
- Node.js applications embedding hashi-vault-js for HashiCorp Vault integration
- Downstream services that forward untrusted identifiers to hashi-vault-js methods
Discovery Timeline
- 2026-07-31 - CVE-2026-55100 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-55100
Vulnerability Analysis
The library builds Vault API URLs by concatenating caller-supplied identifiers directly into the request path. Identifier parameters such as name, username, group, role, and version are inserted without percent-encoding. An attacker who controls any of these values can inject ../ sequences, additional path segments, or query string delimiters. The Vault server then receives a request that targets a different endpoint or mount than the calling code intended.
Query parameter injection extends the impact. Because the library does not use URLSearchParams, characters such as &, =, and ? pass through unescaped. Attackers can append or override query parameters and change the semantics of read, list, or write operations. The result is a confused-deputy pattern where the client application authorizes a request that reaches an unintended Vault path.
Root Cause
The root cause is missing output encoding on URL construction inside src/Vault.js. Node.js provides encodeURIComponent() for path segments and URLSearchParams for query strings, but the affected code paths use raw string concatenation instead. This violates the [CWE-23] boundary between untrusted data and structured URL syntax.
Attack Vector
Exploitation requires only that attacker-controlled data reach one of the vulnerable identifier arguments. No authentication to the calling application is required by the library itself, though the network reachability of the Vault backend gates the ultimate impact. An attacker submits crafted values containing path separators or query delimiters. The library forwards the resulting URL to Vault, which processes it as a legitimate API call. See the GitHub Security Advisory GHSA-g956-2f74-rmv7 for the maintainer analysis.
No public proof-of-concept exploit code is available at time of publication. Refer to the GitHub Pull Request #66 and the remediation commit for the code-level fix.
Detection Methods for CVE-2026-55100
Indicators of Compromise
- Vault audit log entries containing %2F, .., or unexpected path segments inside identifier positions such as name, role, or group
- Vault requests originating from Node.js services where the URL path contains embedded ? or & characters inside a single identifier segment
- Application logs recording user input that includes ../, %2e%2e, or Vault mount names the caller should not reference
Detection Strategies
- Enable Vault audit devices and inspect the request.path field for traversal patterns and injected query parameters.
- Perform a software composition analysis scan across Node.js projects to identify hashi-vault-js versions earlier than 0.5.2.
- Add unit tests that feed identifier fields with ../, %2f, ?, and & characters and assert that outbound URLs remain within the expected namespace.
Monitoring Recommendations
- Forward Vault audit logs to a centralized analytics platform and alert on anomalous path patterns per client identity.
- Monitor egress HTTP traffic from application servers for Vault API URLs containing unusual encoded sequences.
- Track dependency inventory changes to confirm that patched hashi-vault-js versions replace vulnerable ones across all environments.
How to Mitigate CVE-2026-55100
Immediate Actions Required
- Upgrade hashi-vault-js to version 0.5.2 or later across all Node.js services.
- Audit application code for locations where untrusted input flows into name, username, group, role, or version parameters.
- Review Vault audit logs for prior requests containing traversal or query injection markers and rotate any secrets that may have been accessed.
Patch Information
The fix is delivered in hashi-vault-js v0.5.2. The patched code applies encodeURIComponent() to path identifiers and constructs query strings with URLSearchParams. Details are documented in the remediation commit.
Workarounds
- Validate and sanitize identifier inputs at the application boundary, rejecting values containing /, \, ?, &, =, #, or percent-encoded equivalents.
- Constrain Vault token policies so that the calling application cannot reach mounts or paths outside its intended scope, limiting the blast radius of any traversal attempt.
- Wrap library calls in a helper that manually applies encodeURIComponent() to identifiers before they reach hashi-vault-js until the upgrade is completed.
# Upgrade hashi-vault-js to the fixed release
npm install hashi-vault-js@0.5.2
npm ls hashi-vault-js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
