CVE-2026-85719

🗓️ 17 Sep 2026 15:52:16Reported by GitHub_MType

AsyncHttpClient 2.1.0-2.16.1 and 3.0.12 leaks SOCKS proxy credentials to origin over plaintext HTTP.

Reporter	Title	Published	Views	Family All 14
Cvelist	CVE-2026-85719 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP	17 Sep 202615:52	–	cvelist
Debian CVE	CVE-2026-85719	17 Sep 202615:52	–	debiancve
EUVD	EUVD-2026-81904	17 Sep 202615:52	–	euvd
Mend	CVE-2026-85719	17 Sep 202615:52	–	mend
NVD	CVE-2026-85719	17 Sep 202616:18	–	nvd
OSV	DEBIAN-CVE-2026-85719	17 Sep 202616:18	–	osv
OSV	UBUNTU-CVE-2026-85719	17 Sep 202616:18	–	osv
Positive Technologies	PT-2026-94385	17 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-85719: Cleartext Transmission of Sensitive Information	17 Sep 202600:00	–	rapid7
RedhatCVE	CVE-2026-85719	29 Sep 202616:37	–	redhatcve

Vulners

Node

asynchttpclient_project async-http-clientRange2.1.0–2.16.1

asynchttpclient_project async-http-clientRange3.0.0–3.0.12

[
  {
    "vendor": "AsyncHttpClient",
    "product": "async-http-client",
    "versions": [
      {
        "version": ">= 2.1.0, < 2.16.1",
        "status": "affected"
      },
      {
        "version": ">= 3.0.0, < 3.0.12",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/AsyncHttpClient/async-http-client/commit/718ed2e86126663a88ea3db7a88cbbf93f0069b5
github	www.github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x5w6-vm3f-pp6f
github	www.github.com/AsyncHttpClient/async-http-client/commit/abaa8bd260beda3b85825ff95069ed11eaf4ca8d
github	www.github.com/AsyncHttpClient/async-http-client/commit/be439b2ec773d12d61914c238d3e8eeaa6f0ba21
github	www.github.com/AsyncHttpClient/async-http-client/commit/4d887704dec22027310f66c81503226722e9bd23

24 Sep 2026 21:16Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00361

SSVC