A medium-severity vulnerability affecting hashi-vault-js versions <= 0.5.1, assigned CVE-2026-55102 with a CVSS score of 7.5, exists in the hashi-vault-js library where sensitive Vault token and secret values are exposed in thrown errors when using API methods due to the raw AxiosError object carrying full configuration, including credentials, which can be inadvertently logged by consuming applications. This occurs because every API method in Vault.js executes throw parseAxiosError(err), returning the raw AxiosError untouched, thereby exposing submitted passwords and secret values via err.config.data. As a result, sensitive information such as tokens, passwords, and secrets may be unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance. Affected versions are prior to 0.5.2.
We recommend you to update hashi-vault-js to version 0.5.2.[/subscribe_to_unlock_form]
A medium-severity vulnerability affecting hashi-vault-js versions <= 0.5.1, assigned CVE-2026-55102 with a CVSS score of 7.5, exists in the hashi-vault-js library where sensitive Vault token and secret values are exposed in thrown errors when using API methods due to the raw AxiosError object carrying full configuration, including credentials, which can be inadvertently logged by consuming applications. This occurs because every API method in Vault.js executes throw parseAxiosError(err), returning the raw AxiosError untouched, thereby exposing submitted passwords and secret values via err.config.data. As a result, sensitive information such as tokens, passwords, and secrets may be unknowingly exposed to application logs, monitoring services, and APM systems via the raw AxiosError. This may lead to authorization bypass or unauthorized access to the underlying Vault instance. Affected versions are prior to 0.5.2.
We recommend you to update hashi-vault-js to version 0.5.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]