hashi-vault-js: Vault token and secret values exposed in thrown errors

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-55102 · Microsoft / collected KEV context

EUVD-2026-77640

GHSA-5pq8-3ffp-7w5m

cve-program · CVE-2026-55102

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2

euvd · EUVD-2026-77640

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2

nvd · CVE-2026-55102

• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2
• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m

osv · GHSA-5pq8-3ffp-7w5m

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js

No related operational record is retained in the current change model.