CVE-2026-48615

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.0.0 through 26.3.0

Description An issue in proxy tunnel error handling may lead to the exposure of proxy credentials within ERR PROXY TUNNEL error messages. This occurs when credentials are embedded in the proxy URL, allowing them to be captured by logs, diagnostics, or other error consumers through specific error handling paths.

Recommendations Update Node.js 22.x to the latest security release. Update Node.js 24.x to the latest security release. Update Node.js 26.x to version 26.3.1 or later.