npmPackage

hashi-vault-js

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-55102Medium 5.8
hashi-vault-js: Vault token and secret values exposed in thrown errors
Affected: fixed in 0.5.2.
Fixed in 0.5.2 (released Jun 10, 2026, 96 days before disclosure).
The latest release, 0.5.3, is not affected.
53% of hashi-vault-js downloads last week were affected versions (12.4K).
CVE-2026-55100High 8.7
hashi-vault-js has a path traversal and query parameter injection
Affected: fixed in 0.5.2.
Fixed in 0.5.2 (released Jun 10, 2026, 51 days before disclosure).
The latest release, 0.5.3, is not affected.
53% of hashi-vault-js downloads last week were affected versions (12.4K).