CVE-2026-486155.9MediumCWE-359
nodejs node vulnerability
nodejs · node
Not in CISA KEV
0.4%probability of exploitation in the next 30 days
34th percentile
050100
Higher than 34% of scored CVEs
5.9MediumCVSS 3.0
LowMediumHighCrit.
DescriptionNVD
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 18 Jun.
- Node.js fixes critical WebCrypto TLS flaws in urgent updateSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.