Node.js versions 22.x, 24.x, and 26.x disclose proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. This occurs because certain error paths interpolate the raw proxy URL, including sensitive credentials, into error messages that are exposed to stderr, logs, and crash reporting services. The vulnerability results from incomplete redaction of proxy credentials in error outputs.