CVE-2026-48615: Node.js Proxy Credential Exposure in ERR_PROXY_TUNNEL

Technical summary

CVE-2026-48615 is a credential exposure vulnerability in Node.js proxy tunnel error handling. The flaw exists in the `ERR_PROXY_TUNNEL` error message generation path. When proxy credentials are embedded in the proxy URL (in the format http://user:[email protected]:port), failed proxy connection attempts trigger error messages that retain the credentials in plaintext. These errors are then processed by error consumers such as application logging frameworks, centralized logging systems, or diagnostic collectors, creating a window for credential exposure. The vulnerability is rooted in insufficient sanitization of proxy credentials during error object construction and is classified as CWE-359 (Privacy Violation through Exposure of Private Information).

Business impact

Exposed proxy credentials can be leveraged to bypass perimeter security controls, intercept or modify enterprise traffic, or pivot into adjacent systems that trust the compromised proxy service. Organizations using embedded proxy credentials in Node.js applications face elevated risk of unauthorized access to internal services and networks. If logs containing exposed credentials are retained in centralized logging systems or forwarded to third-party services, the blast radius extends beyond the immediate application. Additionally, regulatory frameworks such as PCI-DSS, HIPAA, and SOC 2 impose audit and remediation obligations when authentication material is logged or exposed, potentially triggering incident response protocols and compliance escalations.

Affected systems

The vulnerability affects Node.js release lines 22, 24, and 26, all of which are currently supported by the Node.js project. Any application using Node.js with proxy URLs containing embedded credentials is at risk. This includes HTTP clients (built-in http/https modules), dependency packages that rely on Node.js proxy handling, and containerized deployments of Node.js-based services. Organizations should inventory Node.js deployments across development, testing, and production environments, and audit their proxy configuration methods to identify which systems use inline credentials rather than external credential providers.

Exploitability

Exploitation does not require network interaction with the vulnerable application or advanced attack sophistication. The vulnerability is triggered passively: any legitimate proxy connection failure automatically generates an error message containing credentials. An attacker needs only read access to logs or diagnostic output—a capability commonly held by junior administrators, CI/CD pipeline users, log aggregation service operators, or supply-chain actors with access to logging infrastructure. No user interaction is required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects the low barrier to exploitation; however, the attack requires the defender to misconfigure proxy credentials in a URL, making this partially preventable through proper secrets management practices.

Remediation

Immediately stop embedding proxy credentials in Node.js proxy URLs. Instead, configure proxy authentication through environment variables (HTTP_PROXY_USERNAME, HTTP_PROXY_PASSWORD, HTTPS_PROXY_USERNAME, HTTPS_PROXY_PASSWORD) or external secret management systems (HashiCorp Vault, AWS Secrets Manager, etc.). Rotate any proxy credentials that may have been logged or exposed. Apply the patched Node.js version when available—verify against the official Node.js advisory for exact patch versions for your release line. Audit historical logs for proxy credentials and sanitize or remove them. Implement log scrubbing rules to redact credentials from future logs automatically. For organizations unable to update immediately, implement network-level access controls to restrict proxy usage and log retention policies that limit credential visibility.

Patch guidance

Check the official Node.js security advisory for patched versions across release lines 22, 24, and 26. Node.js follows a predictable release cycle; patches are typically issued within a minor or patch release. Prioritize updating production environments first, followed by development and testing infrastructure. Verify the patch by confirming that error messages no longer contain proxy credentials in test scenarios. Test thoroughly in staging to ensure proxy connectivity is not disrupted by the patch.

Detection guidance

Search centralized logs and application error aggregation systems for the string `ERR_PROXY_TUNNEL` combined with common proxy URL patterns (looking for schemes like http://, https://, socks5:// followed by username:password@ syntax). Use SIEM correlation rules to flag error messages containing the pattern of proxy credentials (basic auth in URLs). Monitor proxy server logs for authentication failures originating from Node.js clients, which may indicate active exploitation or reconnaissance. Inspect environment variable configurations and startup scripts for embedded proxy credentials. Automated secrets scanners should be run against log archives to identify exposed credentials that may have already been captured.

Why prioritize this

Although not yet listed in the CISA Known Exploited Vulnerabilities catalog, this vulnerability warrants urgent attention because (1) exploitation is passive and requires no attacker sophistication, (2) it affects all supported Node.js release lines, and (3) the exposure window—error logs—is within the control of operations teams. Organizations using Node.js in production with any form of proxy authentication should patch within 30 days. The severity is HIGH (CVSS 7.5) due to the certainty of credential exposure if misconfiguration exists, and the downstream impact on network perimeter security.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact (credentials exposed) with no integrity or availability impact. The attack vector is network (errors are generated during normal operations), attack complexity is low (proxy failure is not rate-limited or difficult to trigger), and no privileges or user interaction are required. The scope is unchanged (impact is limited to the confidentiality of proxy credentials, not broader system integrity). This score appropriately captures the severity of credential exposure while acknowledging that the underlying system functionality (proxy connectivity) is not disrupted.

Frequently asked questions