| Name | CVE-2026-48615 |
| Description | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| nodejs (PTS) | bullseye | 12.22.12~dfsg-1~deb11u4 | fixed |
| bullseye (security) | 12.22.12~dfsg-1~deb11u8 | fixed | |
| bookworm, bookworm (security) | 18.20.4+dfsg-1~deb12u2 | fixed | |
| trixie (security), trixie | 20.19.2+dfsg-1+deb13u2 | fixed | |
| forky, sid | 24.19.0+dfsg+~cs24.13.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| nodejs | source | bullseye | (not affected) | |||
| nodejs | source | bookworm | (not affected) | |||
| nodejs | source | trixie | (not affected) | |||
| nodejs | source | (unstable) | 24.17.0+dfsg+~cs24.13.2-1 |
[trixie] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
[bookworm] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
[bullseye] - nodejs <not-affected> (ERR_PROXY_TUNNEL built-in proxy client is a Node 22+ feature; not present)
https://nodejs.org/en/blog/vulnerability/june-2026-security-releases#proxy-credentials-leaked-in-err_proxy_tunnel-error-message-cve-2026-48615---medium
https://github.com/nodejs/node/commit/9b6af26132f6e87659ce360e6a59f42a03ff1701 (v22.23.0)