The Node.js module hashi-vault-js, used to interact with HashiCorp Vault, improperly exposes sensitive information in thrown errors prior to version 0.5.2. Specifically, the parseAxiosError() function rethrows raw AxiosError objects containing the X-Vault-Token header and request body data, which may include passwords or secret values. Applications that log or report these errors risk leaking live Vault tokens and secrets in plaintext. Such exposure can lead to unauthorized access to the Vault instance under the compromised token's policies. The vulnerability is addressed by updating to version 0.5.2.

Exposed Vault tokens and secret values in error logs or monitoring outputs can lead to unauthorized access to the Vault instance with the privileges of the stolen token. This compromises the confidentiality of secrets managed by Vault. The impact is medium severity given the potential for sensitive data exposure and unauthorized access, but exploitation requires access to error logs or monitoring outputs.

Upgrade hashi-vault-js to version 0.5.2 or later, where the issue is fixed. Avoid logging or exposing raw error objects that may contain sensitive Vault tokens or secrets. Review and sanitize error handling and logging practices to prevent sensitive data leakage.