AZL-91230

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91230.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-91230

Upstream

CVE-2026-48615

Published

2026-06-26T02:16:52Z

Modified

2026-08-28T17:47:44Z

Summary

CVE-2026-48615 affecting package nodejs for versions less than 24.17.0-1

Details

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERR_PROXY_TUNNEL error messages.

When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.

This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48615

Affected packages

Azure Linux:3 / nodejs

Package

Name: nodejs
Purl: pkg:rpm/azure-linux/nodejs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

24.17.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91230.json"