hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors

NPM: hashi-vault-js: Vault token and secret values exposed in thrown errors vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

GHSA-5PQ8-3FFP-7W5M hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

CVE-2026-55100

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-55100

CVE-2026-55100 affects the Node.js module hashi-vault-js . The vulnerable component is the internal path construction in src/Vault.js, which concatenates unencoded identifier values (e.g., name, username, group, role, version) into request paths and query strings instead of using proper encoding,...

CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

NPM: hashi-vault-js has a path traversal and query parameter injection

NPM: hashi-vault-js has a path traversal and query parameter injection vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...