BIT-node-min-2026-48615

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-48615.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-node-min-2026-48615

Aliases

Published

2026-06-29T05:48:49.171Z

Modified

2026-06-29T08:26:29.107059428Z

Summary

[none]

Details

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messages.

When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

Database specific

{
    "cpes": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
    ],
    "severity": "High"
}

References

Affected packages

Bitnami / node-min

Package

Name: node-min
Purl: pkg:bitnami/node-min

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

22.22.3

Fixed

22.23.0

Introduced

24.16.0

Fixed

24.17.0

Introduced

26.3.0

Fixed

26.3.1

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/node-min/BIT-node-min-2026-48615.json"