The hashi-vault-js Node.js module, used to interact with the HashiCorp Vault API, improperly concatenates unencoded identifier values such as name, username, group, role, and version into request paths and query strings. This lack of proper encoding (e.g., using encodeURIComponent() or URLSearchParams) enables relative path traversal and query parameter injection attacks. The vulnerability is tracked as CVE-2026-55100 with a CVSS 4.0 score of 8.7 (high severity). It affects versions prior to 0.5.2, where the issue is resolved.

Exploitation of this vulnerability could allow an attacker to manipulate request paths and query parameters, potentially leading to unauthorized access or manipulation of Vault API requests. The CVSS score of 8.7 indicates a high impact with network attack vector, no privileges required, and no user interaction needed. However, no known exploits in the wild have been reported.

Upgrade to hashi-vault-js version 0.5.2 or later, where the vulnerability is fixed by properly encoding identifier values in request paths and query strings. Since no official patch link or advisory is provided, verify the upgrade from the vendor or project repository. Patch status is not yet confirmed by a vendor advisory; check the official source for current remediation guidance.