CVE-2026-55102

MediumCVSS 5.8

Published: 14/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

hashi-vault-js prior to 0.5.2 passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through logging or monitoring, the live Vault token and request secrets can be stored in plaintext.

Risk Assessment

A stolen Vault token permits unauthorized access to the Vault instance under the token's policies, and exposed passwords or secrets can be used for further attacks. Any application logging exceptions from this library is at risk.

Recommendation

Upgrade hashi-vault-js to version 0.5.2 or later. Additionally, review existing logs and monitoring systems for accidentally stored Vault tokens and revoke any tokens that may have been exposed.

Other vulnerabilities in hashi-vault-js

CVE-2026-55100High
In hashi-vault-js before 0.5.2, src/Vault.js concatenates unencoded identifiers into Vault request paths and query strings without encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection.

Original NVD description (English source)

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS