CVE-2016-10530

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can often times contain secret keys and other sensitive values. A malicious user could be on the same network as a regular user and intercept all the secret keys the user is sending. This goes against common best practice, which is to use HTTPS.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-310

Affected software

Vendor	Product	Versions
HackerOne	airbrake node module	<=0.3.8

References

https://github.com/airbrake/node-airbrake/issues/70Broken Link, Third Party Advisory
https://nodesecurity.io/advisories/96Third Party Advisory
https://github.com/airbrake/node-airbrake/issues/70Broken Link, Third Party Advisory
https://nodesecurity.io/advisories/96Third Party Advisory

Timeline

Published: May 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-105316.1marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parses input, specificall CVE-2016-105329.8console-io is a module that allows users to implement a web console in their application. A malicious user could bypass the authentication a CVE-2016-105338.8express-restify-mongoose is a module to easily create a flexible REST interface for mongoose models. express-restify-mongoose 2.4.2 and earl CVE-2016-105345.9electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--str CVE-2016-105355.9csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail first string compar CVE-2016-105365.9engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-directional communicatio CVE-2016-105375.4backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your R CVE-2016-105383.5The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user CVE-2016-105397.5negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "A CVE-2016-10549.8Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acro CVE-2016-105407.5Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `m CVE-2016-105419.8The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that