AIKIDO-2025-10721

TL;DR

Affected versions of this package are vulnerable to Information Exposure via Stack Trace, where the application returns an error object, including stack traces, in JSON responses due to code like return res.status(finalError.statusCode).json(finalError).end(). It exposes sensitive details such as file paths, internal IP addresses, or system structure. An attacker can exploit this by sending malicious requests to trigger errors, potentially harvesting this information to aid in further attacks.