CVE-2026-55102
Received Received - Intake

Information Exposure in hashi-vault-js Node.js Module

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55102
EUVD
EUVD-2026-77640

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
hashicorp hashi-vault-js 0.5.2
kyndryl-open-source hashi-vault-js to 0.5.2 (exc)
kyndryl-open-source hashi-vault-js 0.5.2
kyndryl-open-source hashi-vault-js From 0.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in hashi-vault-js (versions 0.5.1 and earlier) involves error handling that exposes sensitive data like Vault tokens and secret values in plaintext. When API methods fail, they throw a raw AxiosError containing the X-Vault-Token header and request body. If applications log these errors, the credentials are stored in plaintext and could be accessed by unauthorized parties.

Detection Guidance

Check if your application uses hashi-vault-js version 0.5.1 or earlier. Review error logs for plaintext exposure of Vault tokens or secrets in AxiosError objects. Use commands like npm list hashi-vault-js to verify the installed version.

Impact Analysis

This vulnerability allows attackers to steal Vault tokens and secret values if error logs are exposed. A stolen token could grant unauthorized access to the Vault instance, potentially leading to data breaches or policy violations. Applications using affected versions risk leaking credentials through logs, monitoring tools, or crash reports.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. If credentials are exposed, organizations may face legal penalties, fines, or reputational damage for failing to secure confidential information.

Mitigation Strategies

Upgrade hashi-vault-js to version 0.5.2 or later. Implement exception sanitization before logging to redact sensitive data. Review and purge any logs that may have captured plaintext secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart