{"id":"GHSA-jmqm-f2gx-4fjv","aliases":["CLSA-2026-1776299664"],"status":"published","title":"Sensitive information exposure through logs in npm-registry-fetch","description":"Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e`. The password value is not redacted and is printed to stdout and also to any generated log files.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2020-07-07T18:59:10Z","modified":"2026-10-15T09:47:49Z","fixes":[{"ecosystem":"npm","package":"npm-registry-fetch","fixed_in":["4.0.5","8.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"npm-registry-fetch","fixed_in":["3.9.1-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"npm-registry-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"npm-registry-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"8.1.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"npm-registry-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.1-tuxcare.0"},{"fixed":"3.9.1-tuxcare.1"}]}],"versions":["3.9.1"]},{"source":"osv","ecosystem":"npm","package":"npm-registry-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"npm-registry-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"8.1.1"}]}]}],"references":[{"url":"https://github.com/npm/npm-registry-fetch/security/advisories/GHSA-jmqm-f2gx-4fjv","tags":["web"]},{"url":"https://github.com/npm/npm-registry-fetch/pull/29","tags":["web"]},{"url":"https://github.com/npm/npm-registry-fetch/commit/18bf9b97fb1deecdba01ffb05580370846255c88","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-NPMREGISTRYFETCH-575432","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jmqm-f2gx-4fjv"},{"url":"https://github.com/npm/npm-registry-fetch","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-jmqm-f2gx-4fjv","title":"Sensitive information exposure through logs in npm-registry-fetch","description":"Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e`. The password value is not redacted and is printed to stdout and also to any generated log files.","status":"published","published":"2020-07-07T18:59:10Z","modified":"2023-01-09T05:03:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"osv":[{"id":"GHSA-jmqm-f2gx-4fjv","title":"Sensitive information exposure through logs in npm-registry-fetch","description":"Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e`. The password value is not redacted and is printed to stdout and also to any generated log files.","status":"published","published":"2020-07-07T18:59:10Z","modified":"2021-09-22T19:00:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"CLSA-2026-1776299664","title":"TuxCare security update for npm-registry-fetch (1 CVE)","description":"TuxCare rebuilt npm-registry-fetch to address 1 CVE. Fixed in 3.9.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.840624585Z","updated_at":"2026-11-02T15:43:44.009773Z"}]}}