CVE-2026-55102

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

EUVD-2026-77640

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-55102

CVE-2026-55102 affects hashi-vault-js , a Node.js module for interacting with the HashiCorp Vault API, in versions prior to 0.5.2 . Every API method in src/Vault.js rethrows the raw AxiosError via parseAxiosError(), retaining the full Axios configuration including the X-Vault-Token header and err...

CVE-2026-55102: Generation of Error Message Containing Sensitive Information

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55102 via hashi-vault-js (>=0.4.11, <=0.4.16)

hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55102 Source advisory: OSV:GHSA-5PQ8-3FFP-7W5M...

hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

PT-2026-76575

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

CVE-2026-55100

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-55100

CVE-2026-55100 affects the Node.js module hashi-vault-js . The vulnerable component is the internal path construction in src/Vault.js, which concatenates unencoded identifier values (e.g., name, username, group, role, version) into request paths and query strings instead of using proper encoding,...

NPM: hashi-vault-js has a path traversal and query parameter injection

NPM: hashi-vault-js has a path traversal and query parameter injection vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55100 via hashi-vault-js (>=0.4.11, <=0.4.16)

hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55100 Source advisory: OSV:GHSA-G956-2F74-RMV7...

CVE-2026-55100: Relative Path Traversal

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...