Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2026-48615 — HIGH severity vulnerability | Release Alert

CVE-2026-48615

7.5

HIGHCVSS v3

Published

June 26, 2026

Affected

11 projects

Assigned by

[email protected]

Severity scale

010

Description

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

@externs/nodejs

NPMThe Closure Compiler Externs For Node.JS.

= 22.22.3, = 24.16.0, = 26.3.0NVD

GitHubThe Externs For Node.JS.

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPM

More on this CVE

NVD↗GitHub Advisory↗

Mocks Of Built-In Node.JS Modules To Use For Compilation.

= 22.22.3, = 24.16.0, = 26.3.0NVD

@opencensus/nodejs

NPMOpenCensus is a toolkit for collecting application performance and behavior data.

= 22.22.3, = 24.16.0, = 26.3.0NVD

GitHubMocks Of Built-In Node.JS Modules To Use For Compilation.

= 22.22.3, = 24.16.0, = 26.3.0NVD

Python Package IndexPython bindings and utils for Node.js and io.js

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPM

= 22.22.3, = 24.16.0, = 26.3.0NVD

Crates.ioEmbedding Node.js in Rust

= 22.22.3, = 24.16.0, = 26.3.0NVD

NPMsecurity holding package

= 22.22.3, = 24.16.0, = 26.3.0NVD

NuGet GalleryNode.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient. Node.js' package ecosystem, npm, is the largest ecosystem of open source libraries in the world.

= 22.22.3, = 24.16.0, = 26.3.0NVD

Debian Bookwormevented I/O for V8 javascript - runtime executable

= 22.22.3, = 24.16.0, = 26.3.0NVD