CVE-2026-55100

HighCVSS 8.7

Published: 31/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 01/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

46th percentile - higher than 46% of all known CVEs

Summary

In hashi-vault-js before 0.5.2, src/Vault.js concatenates unencoded identifiers into Vault request paths and query strings without encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection.

Risk Assessment

Risk of unauthorized access to Vault resources through path and query parameter manipulation.

Recommendation

Update hashi-vault-js to version 0.5.2 or later.

Other vulnerabilities in hashi-vault-js

CVE-2026-55102Medium
hashi-vault-js prior to 0.5.2 passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through logging or monitoring, the live Vault token and request secrets can be stored in plaintext.

Original NVD description (English source)

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS