Skip to content
Fencer Intel
medium 6.2

CVE-2026-123871 json

Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

published 16h ago modified 15h ago also EUVD-2026-123693

cvss
6.2
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Patch / fix

  • nodejs node 22.23.5, 24.22.3, 26.13.1
  • nodejs Alpine 3.22, Alpine 3.21 22.23.5-r0
  • nodejs Alpine 3.24, Alpine 3.23 24.22.3-r0

alpine advisories ALPINE-CVE-2026-123871

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2026-123871 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-123871 updated cvss 6.2

nodejs: Node.js: Information disclosure via invalid proxy configuration error messages

  • Red Hat Hardened Images nodejs25 25.9.0-1.7.hum1, nodejs20 20.20.2-1.3.hum1, nodejs24 24.22.2-0.2.hum1, nodejs26 26.13.0-0.1.1.hum1, nodejs22 22.23.4-2.3.2.3.1.hum1
    affected: workaround, no fix available, no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CVSS scores

assigned by version score vector
CNA 3.0 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • nodejs node

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.