Answer in brief
CVE-2026-55102 records a Medium severity vulnerability in hashi-vault-js: Vault token and secret values exposed in thrown errors. The current sources do not mark it as known exploited. The current feed maps kyndryl-open-source/hashi-vault-js (generic), hashi-vault-js (npm), hashi-vault-js (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps kyndryl-open-source/hashi-vault-js (generic), hashi-vault-js (npm), hashi-vault-js (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| kyndryl-open-source/hashi-vault-jsgeneric | < 0.5.2 | Not reported |
| hashi-vault-jsnpm | >=0 <0.5.2 | 0.5.2 |
| hashi-vault-jsnpm | <=0.5.1 | 0.5.2 |
Published upstream
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.
Quoted source text, attributed separately from HOL analysis.