GHSA-5pq8-3ffp-7w5m

Source

https://github.com/advisories/GHSA-5pq8-3ffp-7w5m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-5pq8-3ffp-7w5m/GHSA-5pq8-3ffp-7w5m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5pq8-3ffp-7w5m

Aliases

CVE-2026-55102

Published

2026-08-13T14:14:32Z

Modified

2026-08-13T14:41:01Z

Summary

hashi-vault-js: Vault token and secret values exposed in thrown errors

Details

Summary

Vault token and secret values are exposed in thrown errors when using hashi-vault-js.

Details

Every API method in Vault.js executes throw parseAxiosError(err), which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and the request body. Consuming applications that log caught errors (e.g., using console.error, pino, winston, Sentry, or APMs) inadvertently log the live Vault token in plaintext. Furthermore, write-path methods expose submitted passwords and secret values via err.config.data.

Impact

When consuming applications log intercepted exceptions, sensitive credentials such as tokens, passwords, and secrets are unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance.

Patches

This vulnerability should be addressed by redacting err.config.headers['X-Vault-Token'] and err.config.data before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. Users should upgrade to a version that includes this fix.

Workarounds

If users cannot immediately update the library, they can mitigate this issue by capturing all exceptions thrown by hashi-vault-js and sanitizing or omitting the err.config object before passing the errors to logging utilities or crash reporters.

Acknowledgements

hashi-vault-js would like to thank Sebastián Alba Vives for reporting this vulnerability.

Resources

Database specific

{
    "cwe_ids":  [
        "CWE-209",
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-13T14:14:32Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / hashi-vault-js

Package

Name: hashi-vault-js; View open source insights on deps.dev
Purl: pkg:npm/hashi-vault-js

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.5.2

Database specific

last_known_affected_version_range

"<= 0.5.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-5pq8-3ffp-7w5m/GHSA-5pq8-3ffp-7w5m.json"