Listen to this Post
The `hashi-vault-js` library is a Node.js module designed to facilitate interaction with HashiCorp Vault, a popular tool for securely managing secrets and sensitive data. A vulnerability has been identified in versions prior to 0.5.2 that can lead to the unintentional exposure of sensitive credentials. The core of the issue lies in the library’s error handling mechanism.
Every API method in `Vault.js` executes throw parseAxiosError(err), which returns the raw `AxiosError` object untouched. This error object carries the full Axios configuration, including the `X-Vault-Token` header used for authentication and the request body. When a consuming application logs caught errors—a common practice using tools like console.error, pino, winston, Sentry, or APMs—it inadvertently logs the live Vault token in plaintext. Furthermore, for write-path methods, the submitted passwords and secret values are also exposed via err.config.data. This vulnerability is similar in nature to CWE-116 and CWE-74, where improper handling of output can lead to information disclosure.
DailyCVE Form:
Platform: Node.js
Version: <= 0.5.1
Vulnerability: Info Disclosure
Severity: Medium
Date: 2026-08-13
Prediction: 2026-08-20
What Undercode Say:
Analytics
The vulnerability stems from the insecure practice of re-throwing the raw AxiosError object without sanitization. This exposes the full request configuration, including sensitive headers and data, to any error logging mechanism.
Bash commands and codes related to the blog
The following code snippet demonstrates the vulnerable behavior in `hashi-vault-js` versions prior to 0.5.2:
// Vulnerable code example (src/Vault.js prior to 0.5.2)
try {
// Some API call that fails
} catch (err) {
throw parseAxiosError(err); // The raw AxiosError is thrown
}
A consuming application that logs errors would then inadvertently expose the token:
try {
await vault.write('secret/data/my-secret', { password: 'super-secret' });
} catch (err) {
console.error(err); // Logs the full AxiosError, including token and password
}
Exploit: (Educational Purposes!)
An attacker with access to application logs or monitoring systems could extract the Vault token and other secrets from the logged error objects. This could allow them to authenticate to the Vault instance and perform unauthorized actions.
Protection: from this CVE
To protect against this vulnerability, users should upgrade to `hashi-vault-js` version `0.5.2` or later, which addresses this issue by redacting `err.config.headers[‘X-Vault-Token’]` and `err.config.data` before re-throwing, or by throwing a purpose-built error containing only safe properties like status and message. If an immediate upgrade is not possible, applications can mitigate the risk by capturing all exceptions thrown by `hashi-vault-js` and sanitizing or omitting the `err.config` object before passing errors to logging utilities or crash reporters.
Impact
The exposure of Vault tokens and secrets in logs can lead to authorization bypass and unauthorized access to the underlying Vault instance, potentially compromising the entire secret management infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
