CVE-2026-55102: hashi-vault-js Information Disclosure Flaw

CVE-2026-55102 Overview

CVE-2026-55102 is a sensitive information exposure vulnerability in hashi-vault-js, a Node.js module for interacting with the HashiCorp Vault API. Versions prior to 0.5.2 rethrow raw AxiosError objects through the parseAxiosError() helper in src/Vault.js. These error objects retain AxiosError.config and the corresponding response configuration, which include the X-Vault-Token header and the raw request body. When consuming applications log the caught exception through console output, structured loggers, monitoring platforms, or application performance monitoring (APM) tools, live Vault tokens and submitted secrets are stored in plaintext. A stolen token grants unauthorized access to the Vault instance under that token's policies. The issue is fixed in version 0.5.2.

Critical Impact
Vault tokens and submitted secrets can be written to logs and monitoring pipelines in plaintext, enabling unauthorized Vault access to anyone with read access to those outputs.

Affected Products

hashi-vault-js Node.js module versions prior to 0.5.2
Applications using parseAxiosError() from src/Vault.js to handle Vault API failures
Downstream logging, APM, and crash reporting systems that ingest raw error objects from consumers of this library

Discovery Timeline

2026-09-14 - CVE-2026-55102 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in the NVD database

Technical Details for CVE-2026-55102

Vulnerability Analysis

The vulnerability is classified under [CWE-209: Generation of Error Message Containing Sensitive Information]. Every API method in src/Vault.js routes failed HTTP requests through the parseAxiosError() helper. That helper rethrows the underlying AxiosError without stripping the config property or the mirrored response.config property. Axios attaches the full outbound request configuration to these fields, including the X-Vault-Token authentication header and the data payload sent to Vault.

When a caller catches the rethrown error and forwards it to a logger, an APM agent, or a crash reporter, the serializer typically walks the object graph and captures the token and request body verbatim. Any operator, contractor, or attacker with read access to those log stores gains a valid Vault token. The token retains whatever policies the calling identity holds, so the impact scales with the privilege of the failing operation, for example password writes, KV secret reads, or PKI signing.

Root Cause

The root cause is missing redaction in the error normalization path. parseAxiosError() preserved diagnostic context useful for developers but did not sanitize authentication material or request bodies before propagating the error. Because the library is the sole abstraction over the Vault HTTP API for its consumers, the leak occurs on any failed request rather than on a specific edge case.

Attack Vector

Exploitation is passive and local to the observability stack. An attacker with read access to application logs, error tracking dashboards, or APM traces harvests the exposed X-Vault-Token value, then reuses it against the Vault instance. Any transient Vault failure — including network errors, policy denials, or malformed requests — is sufficient to produce a leaked token in the log stream.

javascript

// Fix applied in src/Vault.js (v0.5.2)
// Redact sensitive data from the original request
if (error.config) {
  if (error.config.headers && error.config.headers['X-Vault-Token']) {
    error.config.headers['X-Vault-Token'] = '[REDACTED]';
  }
  if (error.config.data) {
    error.config.data = '[REDACTED]';
  }
}
if (error.response && error.response.config) {
  if (error.response.config.headers && error.response.config.headers['X-Vault-Token']) {
    error.response.config.headers['X-Vault-Token'] = '[REDACTED]';
  }
  if (error.response.config.data) {
    error.response.config.data = '[REDACTED]';
  }
}

Source: GitHub Commit ed0797a

Detection Methods for CVE-2026-55102

Indicators of Compromise

Log entries, APM spans, or crash reports containing the literal string X-Vault-Token followed by a token value rather than [REDACTED]
Serialized AxiosError objects in log stores with populated config.headers or response.config.headers fields
Vault audit log entries showing token use from unexpected source IP addresses or user agents that do not match the application's normal callers

Detection Strategies

Scan centralized logging platforms and error trackers for patterns matching Vault token formats (for example hvs., hvb., or legacy UUID-style tokens) adjacent to AxiosError stack frames.
Run a software composition analysis (SCA) sweep across Node.js projects to enumerate installations of hashi-vault-js older than 0.5.2.
Cross-reference Vault audit logs against known application client identities to flag token reuse from unexpected origins.

Monitoring Recommendations

Enable Vault audit device logging and alert on token operations that originate outside of approved network segments.
Add log-side redaction rules for X-Vault-Token headers as a defense-in-depth control against future library regressions.
Route error telemetry through a normalization layer that strips error.config and error.response.config before ingestion into third-party APM or crash reporting services.

How to Mitigate CVE-2026-55102

Immediate Actions Required

Upgrade hashi-vault-js to version 0.5.2 or later across all Node.js services.
Rotate any Vault tokens that may have been transmitted by affected application versions, including tokens issued to service accounts and CI/CD pipelines.
Purge or restrict access to log archives, APM traces, and crash reports that captured errors from the vulnerable library.

Patch Information

The fix ships in hashi-vault-js0.5.2. The patch, tracked in GitHub Pull Request #67 and released via GitHub Release v0.5.2, redacts the X-Vault-Token header and the request data field on both error.config and error.response.config before rethrowing. Additional context is available in GitHub Security Advisory GHSA-5pq8-3ffp-7w5m.

Workarounds

Wrap all calls to hashi-vault-js in a try/catch block and delete err.config and err.response?.config before logging or rethrowing.
Configure logging frameworks (Winston, Pino, Bunyan) with a serializer that strips headers and request bodies from AxiosError instances.
Scope Vault tokens with short TTLs and least-privilege policies so that leaked tokens expire quickly and expose limited data.

bash

# Upgrade the package to the fixed release
npm install hashi-vault-js@0.5.2

# Verify the resolved version
npm ls hashi-vault-js

# Audit for remaining vulnerable installations
npm audit --json | jq '.vulnerabilities["hashi-vault-js"]'