Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123871
Proxy credential leak in Node.js ERR_PROXY_INVALID_CONFIG
- CVSS 3.0
- 6.2 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Node.js interpolates a raw proxy URL, including username and password, into ERR_PROXY_INVALID_CONFIG on four error paths that an earlier redaction fix missed, including one in the same constructor. The URL comes from the environment. A local actor needs no privileges or user interaction to trigger the invalid-config paths, and the secret is written to stderr, container logs, log aggregation, and crash reporting. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Apply the Node.js security update for CVE-2026-123871. Fixed versions are not listed.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-209
- Vector
- CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N