Description
The global error handler in the Express application returns err.stack or the full error object in the JSON response body for all environments. This exposes internal file paths (e.g., /home/ubuntu/riveto/routes/auth.js:78), Node.js version, and dependency names to any client who triggers an error.
Steps to Reproduce
- Send a request with an invalid JSON body to any POST endpoint:
curl -X POST http://localhost:3000/api/login -d 'notjson' -H "Content-Type: application/json"
- Observe the response contains a
stack field showing internal paths.
Root Cause
The error handler sends err.stack unconditionally, without checking NODE_ENV.
Impact
Information disclosure that helps attackers map the server filesystem, identify vulnerable dependencies by version, and target specific lines of code.
Proposed Fix
app.use((err, req, res, next) => {
const isProduction = process.env.NODE_ENV === "production";
res.status(err.status || 500).json({
error: isProduction ? "An error occurred." : err.message,
...(isProduction ? {} : { stack: err.stack }),
});
});
Description
The global error handler in the Express application returns
err.stackor the full error object in the JSON response body for all environments. This exposes internal file paths (e.g.,/home/ubuntu/riveto/routes/auth.js:78), Node.js version, and dependency names to any client who triggers an error.Steps to Reproduce
curl -X POST http://localhost:3000/api/login -d 'notjson' -H "Content-Type: application/json"stackfield showing internal paths.Root Cause
The error handler sends
err.stackunconditionally, without checkingNODE_ENV.Impact
Information disclosure that helps attackers map the server filesystem, identify vulnerable dependencies by version, and target specific lines of code.
Proposed Fix