[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-48615":6},{"stargazers_count":4,"fetched_at":5},7,"2026-07-31T11:19:25.255Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":85,"aliases":86,"duplicate_of":9,"upstream":87,"downstream":88,"duplicates":137,"related":138,"reserved_at":9,"published_at":148,"modified_at":149,"state":150,"summary":151,"references_raw":160,"kevs":165,"epss":166,"epss_history":169,"metrics":200,"affected":206},"CVE-2026-48615","A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.\r\n\r\nWhen proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.\r\n\r\nThis vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-359","Exposure of Private Personal Information to an Unauthorized Actor","The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.","weakness","Incomplete","Base",[19,73,77,81],{"id":20,"name":21,"techniques":22},"CAPEC-464","Evercookie",[23],{"id":24,"name":25,"tactics":26,"countermeasures":30},"T1606.001","Web Cookies",[27],{"id":28,"name":29},"TA0031","Credential Access",[31,36,41,45,50,55,59,63,68],{"id":32,"name":33,"tactic":34},"D3-CCSA","Credential Compromise Scope Analysis",{"name":35},"Detect",{"id":37,"name":38,"tactic":39},"D3-CR","Credential Revocation",{"name":40},"Evict",{"id":42,"name":43,"tactic":44},"D3-ANCI","Authentication Cache Invalidation",{"name":40},{"id":46,"name":47,"tactic":48},"D3-DUC","Decoy User Credential",{"name":49},"Deceive",{"id":51,"name":52,"tactic":53},"D3-CH","Credential Hardening",{"name":54},"Harden",{"id":56,"name":57,"tactic":58},"D3-MFA","Multi-factor Authentication",{"name":54},{"id":60,"name":61,"tactic":62},"D3-CRO","Credential Rotation",{"name":54},{"id":64,"name":65,"tactic":66},"D3-RIC","Reissue Credential",{"name":67},"Restore",{"id":69,"name":70,"tactic":71},"D3-CTS","Credential Transmission Scoping",{"name":72},"Isolate",{"id":74,"name":75,"techniques":76},"CAPEC-467","Cross Site Identification",[],{"id":78,"name":79,"techniques":80},"CAPEC-498","Probe iOS Screenshots",[],{"id":82,"name":83,"techniques":84},"CAPEC-508","Shoulder Surfing",[],[],[],[],[89,91,93,95,97,99,101,103,105,107,109,111,113,115,117,119,121,123,125,127,129,131,133,135],{"_key":90},"OPENSUSE-SU-2026:11110-1",{"_key":92},"SUSE-SU-2026:2633-1",{"_key":94},"OPENSUSE-SU-2026:11121-1",{"_key":96},"SUSE-SU-2026:2647-1",{"_key":98},"DEBIAN-CVE-2026-48615",{"_key":100},"ALPINE-CVE-2026-48615",{"_key":102},"UBUNTU-CVE-2026-48615",{"_key":104},"SUSE-SU-2026:22368-1",{"_key":106},"SUSE-SU-2026:2695-1",{"_key":108},"OPENSUSE-SU-2026:21058-1",{"_key":110},"OPENSUSE-SU-2026:21236-1",{"_key":112},"MGASA-2026-0257",{"_key":114},"SUSE-SU-2026:22565-1",{"_key":116},"RHSA-2026:28727",{"_key":118},"RHSA-2026:29012",{"_key":120},"RHSA-2026:30172",{"_key":122},"RHSA-2026:35841",{"_key":124},"RHSA-2026:35842",{"_key":126},"RHSA-2026:35891",{"_key":128},"RHSA-2026:35892",{"_key":130},"RHSA-2026:39246",{"_key":132},"RHSA-2026:39868",{"_key":134},"RHSA-2026:7378",{"_key":136},"RHSA-2026:9455",[],[139,140,141,142,143,144,145,146,147],{"_key":90},{"_key":92},{"_key":94},{"_key":96},{"_key":104},{"_key":106},{"_key":108},{"_key":110},{"_key":114},"2026-06-26T01:14:36.524Z","2026-06-26T13:35:00.592Z","PUBLISHED",{"cisa_kev":152,"cisa_ransomware":152,"cisa_vendor":9,"epss_severity":153,"epss_score":154,"severity":155,"severity_score":156,"severity_version":157,"severity_source":158,"severity_vector":159,"severity_status":150},false,"low",0.00437,"medium",5.9,"v3.0","cve.org","CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",[161],{"url":162,"sources":163,"tags":164},"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases",[158],[],[],{"date":167,"score":154,"percentile":168},"2026-07-05",0.35123,[170,174,178,181,184,187,190,193,196,199],{"date":171,"score":172,"percentile":173},"2026-06-26",0.0038,0.29849,{"date":175,"score":176,"percentile":177},"2026-06-27",0.00392,0.3102,{"date":179,"score":176,"percentile":180},"2026-06-28",0.30994,{"date":182,"score":176,"percentile":183},"2026-06-29",0.30995,{"date":185,"score":176,"percentile":186},"2026-06-30",0.30969,{"date":188,"score":154,"percentile":189},"2026-07-01",0.35052,{"date":191,"score":154,"percentile":192},"2026-07-02",0.35079,{"date":194,"score":154,"percentile":195},"2026-07-03",0.35098,{"date":197,"score":154,"percentile":198},"2026-07-04",0.35109,{"date":167,"score":154,"percentile":168},[201],{"source":158,"cvss_v2_0":9,"cvss_v3_0":202,"cvss_v3_1":9,"cvss_v4_0":9},{"baseScore":156,"baseSeverity":203,"vectorString":159,"impactScore":204,"exploitabilityScore":205},"MEDIUM",6,5.6,[207],{"ecosystem":9,"name":208,"vendor":209,"product":208,"cpe_part":210,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":211},"node","nodejs","a",[212,217,220],{"version":213,"is_range":214,"range_type":158,"version_start":215,"version_start_type":216,"version_end":215,"version_end_type":216,"fixed_in":9},">= 22.22.3, \u003C= 22.22.3",true,"22.22.3","including",{"version":218,"is_range":214,"range_type":158,"version_start":219,"version_start_type":216,"version_end":219,"version_end_type":216,"fixed_in":9},">= 24.16.0, \u003C= 24.16.0","24.16.0",{"version":221,"is_range":214,"range_type":158,"version_start":222,"version_start_type":216,"version_end":222,"version_end_type":216,"fixed_in":9},">= 26.3.0, \u003C= 26.3.0","26.3.0"]