CVE-2026-48615 is a privacy violation vulnerability (CWE-359) in Node.js where proxy credentials embedded in proxy URLs can be exposed via error messages generated during proxy tunnel failures. Specifically, the ERR_PROXY_TUNNEL error messages may include sensitive proxy credentials, which can be inadvertently logged or exposed to diagnostic tools. This affects Node.js versions 22.22.3, 24.16.0, and 26.3.0. No official patch or remediation guidance is currently provided by the vendor.

The vulnerability can lead to the exposure of proxy credentials through error messages, potentially compromising sensitive authentication information. This exposure could allow unauthorized parties who have access to logs or error outputs to obtain proxy credentials. There is no indication of direct system compromise or code execution, but the confidentiality of proxy credentials is at risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid embedding proxy credentials directly in proxy URLs or ensure that error messages and logs do not capture sensitive information. Monitor vendor communications for updates on patches or official mitigations.