curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies

A flaw was found in curl. When curl is configured to use distinct proxies for different URL schemes, a redirect from a URL using an authenticated proxy to one using an unauthenticated proxy can inadvertently expose the initial proxy's credentials. This improper credential management CWE-522 may...

UBUNTU-CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

Linux Distros Unpatched Vulnerability : CVE-2026-123871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js err...

DEBIAN-CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

ALPINE-CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

EUVD-2026-123693

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

CVE-2026-123871

Node.js versions 26.x, 24.x, and 22.x are vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages. The root cause is that certain error paths—including one within the same constructor addressed in CVE-2026-48615—fail to redact raw proxy URLs. Consequently, secrets (u...

CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

CVE-2026-123871 Node.js is vulnerable to proxy credential disclosure via ERR_PROXY_INVALID_CONFIG error messages

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

CVE-2026-123871

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

Node.js < 22.23.5, < 24.22.3, < 26.13.1 - Generation of Error Message Containing Sensitive Information in ERR_PROXY_INVALID_CONFIG leading to Proxy Credential Disclosure

Generation of Error Message Containing Sensitive Information in ERRPROXYINVALIDCONFIG leading to Proxy Credential Disclosure vulnerability discovered by ? in WordPress npm Node.js versions 26.13.1...

PT-2026-145391

Node.js discloses proxy credentials in ERR PROXY INVALID CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, o...

CVE-2026-123871: nodejs node: Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages

Node.js discloses proxy credentials in ERRPROXYINVALIDCONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one ...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. CVE-2026-15711:...

EUVD-2026-108631

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...

CVE-2026-115657 KNIME Analytics Platform logs credentials of configured proxy when used as an executor

When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured credentials of proxies during startup. An attacker with access to log files can steal the credentials and use the proxy as the user who configured the proxy...