Stack trace leaked in error response
Returning an error's `.stack` to the client exposes absolute file paths, dependency versions, and internal call structure. Attackers use it to map the application and to fingerprint vulnerable dependency versions. Log the stack server-side and return a generic message.
high likely application source OWASP A05:2021 / CWE-209
What it looks like
HIGH likely Stack trace leaked in error response A05:2021
app/api/users/route.ts:20:16
18 │ } catch (err) {
19 │ return NextResponse.json(
20 │ { error: err.stack },
│ ~~~~~~~~~ leaks internal stack trace to the client
21 │ { status: 500 }
22 │ )
From app/api/users/route.ts in the fixture suite.
The fixture test asserts this finding.
How to fix it
Log the error server-side and return a generic message to the client.
'Internal Server Error'The fix for your framework
Choose the API used by your project.
- Next.js
- Nuxt
- NestJS
- Express
- Fastify
- Hono
- Koa
- Hapi
- Sails.js
- Astro
- Remix
- Gatsby
- SvelteKit
- TanStack Start
- SolidStart
- Elysia
Check your own repository
npx owlwarden scan --preset deep
npx owlwarden explain stack-trace-leak
explain prints the rule and fixes in the terminal. It does not
use the network.