MEDIUM GitHub
CVE-2026-55102
hashi-vault-js: Vault token and secret values exposed in thrown errors
## Summary
Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`.
## Details
Every API method in `Vault.js` executes `throw parseAxiosError(err)`, which returns the raw `AxiosError` untouched. That error carries the full Axios configuration, including the `X-Vault-Token` header and the request body. Consuming applications that log caught errors (e.g., using `console.error`, `pino`, `winston`, Sentry, or APMs) inadvertently log the live Vault token in plaintext
Affected Products
- npm/hashi-vault-js <= 0.5.1
References
- https://github.com/advisories/GHSA-5pq8-3ffp-7w5m
- https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7
- https://github.com/advisories/GHSA-5pq8-3ffp-7w5m
This medium severity vulnerability was published on 2026-08-13 via GitHub. Affected: npm/hashi-vault-js <= 0.5.1.
vulnfeed aggregates 10617 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.