Information Exposure Through Error Messages

Description

Detects exposure of sensitive error information (error.message, error.stack, raw error objects) in HTTP responses. This can leak: - Internal file paths and directory structure - Database schema and query details - Third-party API endpoints and credentials - Software versions and technology stack - Business logic and validation rules Attackers use this information to: - Map internal architecture - Identify vulnerable dependencies - Craft targeted attacks - Bypass security controls

What Shoulder detects

Sensitive error information (message, stack, or raw error object) is exposed in HTTP response.
Error details can reveal internal architecture, file paths, database schema, and other
sensitive information to attackers.

How to fix

Return generic error messages to users and log detailed errors server-side.

```javascript
} catch (error) {
  logger.error('Failed', { error: error.message });
  res.status(500).json({ error: 'An error occurred' });
}
```

Learn more: https://shoulder.dev/learn/javascript/cwe-209/error-message-exposure

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

express fastify nextjs nodejs

References

Documentation ↗ OWASP ↗ Learn about CWE-209

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-error-message-exposure .