A flaw in Node.js proxy tunnel error handling can expose proxy credentials that are embedded in the proxy URL throughNEL error messages. These credentials may be captured by logs, diagnostics, or other error consumers, resulting in the disclosure of sensitive authentication data.

Node.js, all supported release lines – Node.js 22, Node.js 24, and Node.js 26 – are impacted by this vulnerability.

The CVSS score of 5.9 is available and the vulnerability is not listed in the CISA KEV catalog. The EPSS score of < 1% indicates a very low probability of exploitation. The likely attack vector is either local or remote access to the application’s error handling environment; an attacker or user with access to logs or error output could capture the exposed credentials. Exploitation requires only that an error occurs with a proxy URL containing credentials, and the exposed data will appear in the resulting error message.