Bug 2493335 (CVE-2026-48615)

Summary:	CVE-2026-48615 nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kaycoth, rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs, diagnostics, or other error-consuming mechanisms.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2493818, 2493819, 2493820
Bug Blocks:

Description OSIDB Bzimport 2026-06-26 02:02:23 UTC

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.

When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.

This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

Comment 2 errata-xmlrpc 2026-07-06 04:37:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:35841 https://access.redhat.com/errata/RHSA-2026:35841

Comment 3 errata-xmlrpc 2026-07-06 05:16:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:35842 https://access.redhat.com/errata/RHSA-2026:35842

Comment 4 errata-xmlrpc 2026-07-06 14:23:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:35891 https://access.redhat.com/errata/RHSA-2026:35891

Comment 5 errata-xmlrpc 2026-07-06 14:45:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:35892 https://access.redhat.com/errata/RHSA-2026:35892

Comment 6 errata-xmlrpc 2026-07-14 12:31:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:39246 https://access.redhat.com/errata/RHSA-2026:39246

Comment 7 errata-xmlrpc 2026-07-15 11:23:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39868 https://access.redhat.com/errata/RHSA-2026:39868

Comment 8 errata-xmlrpc 2026-07-20 13:07:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:41947 https://access.redhat.com/errata/RHSA-2026:41947

Comment 9 errata-xmlrpc 2026-08-10 02:41:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:52399 https://access.redhat.com/errata/RHSA-2026:52399