CVE-2026-123871 · Runtime
NO FIX YET
Node.js writes proxy URLs, including any username and password, verbatim into ERR_PROXY_INVALID_CONFIG error messages in four code paths that the earlier redaction fix missed. Anyone who can read those logs, stderr output, or crash reports can recover the proxy credentials.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications running on affected Node.js 22.x, 24.x or 26.x that use a proxy configured with credentials in the environment and that send error output to logs or crash reporting. Systems without credentials in the proxy URL, or without invalid proxy configuration reaching error output, are less exposed. The sources do not state a fixed version.
Not affected if no-proxy-credentials, proxy-not-configured
Who cares ci, logging, node.js, self-hosted
node --version and compare against the affected lines: 22.x, 24.x, 26.x.HTTP_PROXY, HTTPS_PROXY) include a username and password.ERR_PROXY_INVALID_CONFIG.No fix yet, per the sources.
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
This page as .md · .json · CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.