hashi-vault-js: Vault token and secret values exposed in thrown errors

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-55102 · CVE overview and exploitation status

EUVD-2026-77640

GHSA-5pq8-3ffp-7w5m

cve-program · CVE-2026-55102

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2

euvd · EUVD-2026-77640

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2

nvd · CVE-2026-55102

• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ed0797a2d09c1fe0fd20764dde66cbc29241d9fb
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/67
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2
• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m

osv · GHSA-5pq8-3ffp-7w5m

• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-5pq8-3ffp-7w5m
• https://github.com/kyndryl-open-source/hashi-vault-js

No related changes are available here.