Node.js · Report #3720313
Proxy credentials leaked in ERR_PROXY_TUNNEL error message
Validstatus
mediumseverity
4upvotes
25 Jun 2026disclosed
Summary
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.