In hashi-vault-js versions before 0.5.2, every API method throws raw Axios errors containing the full Axios configuration, including the X-Vault-Token header and request body data. This leads to exposure of Vault tokens, passwords, and secret values in error logs when consuming applications log these exceptions. The vulnerability arises from improper handling of error objects that include sensitive information. The recommended remediation is to redact sensitive headers and data from errors before rethrowing or to throw sanitized errors containing only safe properties such as status and message.

Sensitive Vault tokens and secret values can be exposed in plaintext within application logs, monitoring services, and application performance monitoring systems if the consuming application logs the raw errors thrown by hashi-vault-js. This exposure may lead to unauthorized access or authorization bypass of the Vault instance if attackers gain access to these logs or monitoring data.

A patch is available that addresses this vulnerability by redacting sensitive information from error objects before they are thrown. Users should upgrade to version 0.5.2 or later that includes this fix. If immediate upgrade is not possible, users should implement a workaround by capturing all exceptions thrown by hashi-vault-js and sanitizing or omitting the err.config object before passing errors to logging or crash reporting tools.