# Debug and error page information leak Verbose error/debug pages dumping env, paths, secrets, or hidden data to clients _Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; latest 2026-10-07. Updated 2026-11-02._ ## How it works A debug or error path serializes internal state (environment variables, headers, cookies, absolute paths, file contents, or pre-redaction text) into a response sent to the client. The assumption that breaks is that the debug path is only reachable in development, or that its output is harmless. In practice a convenience default, a feature flag, or a stale index keeps the verbose output live in production or exposes it to any network peer [E1](https://bugbountylibrary.com/r/h1%3A685909.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md). ## Where it shows up - Error renderers that splice `JSON.stringify(data)` or similar into raw HTML/script text [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md) - Debug flags set unconditionally by a feature branch (e.g. single-file mode) before a `--prod` clamp runs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md) - Extension- or route-specific resets that only fire for some inputs, leaving others in debug [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md) - Search indexes or caches built from mutable fields that are not refreshed after edits/redaction [E1](https://bugbountylibrary.com/r/h1%3A685909.md) - Error pages returning HTTP 200 with full source or absolute paths [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md) ## How to review Trace every path that can render an error or debug page and confirm the invariant: **no client-reachable response contains environment, headers, cookies, absolute paths, file contents, or pre-redaction text unless an explicit, correctly-ordered production guard disables it for all inputs**. Check ordering between feature-detection defaults and hardening flags; check that resets cover every extension/route, not just one [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md). For any escaping of ``, verify a case-insensitive match against all tokenizer-legal terminators, not a literal `replaceAll` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md). For search/index leaks, verify the index is rebuilt whenever the source field changes, including inside nested transactions [E1](https://bugbountylibrary.com/r/h1%3A685909.md). ## How finders spotted it - Searched for a term absent from a report's public markup, saw it returned, hypothesized the index held hidden content, then probed with a word list [E1](https://bugbountylibrary.com/r/h1%3A685909.md) - Noticed env/headers/cookies serialized into a script element and that the guard was a literal `replaceAll`; reasoned about HTML tokenizer raw-text end rules versus exact-string matching, compared to a correct case-insensitive regex elsewhere in the project, and validated with a harness plus headless browser controls [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md) - Code review of config ordering (single-file detection vs final configuration), then live comparison of single-file vs directory mode and testing which extensions reach the error renderer [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md) ## Variants seen - Stale search vector retaining redacted title words after an edit [E1](https://bugbountylibrary.com/r/h1%3A685909.md) - SSR/SSG dev error page dumping full shell environment, headers and cookies, with a bypassable `` escape [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md) - Single-file mode forcing debug on, leaking paths and sibling file contents, bypassing `--prod` for non-`.lua` extensions [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md) ## Impact and severity Leaked secrets (DB strings, API keys, JWT signing secrets, admin credentials) enable further compromise [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md); leaked tokens plus script execution in the dev-server origin, with cookies widening reach across localhost ports [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md); hidden report terms reconstructed at scale via dictionary probing [E1](https://bugbountylibrary.com/r/h1%3A685909.md). Severity rises when the leak chains with injection or reaches production deployments. ## Seen in real software Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix. - **@quasar/render-ssr-error (npm)** <= 2.2.3, fixed in 2.2.4: Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable (CVE-2026-106106). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md. Fix: https://github.com/quasarframework/quasar/commit/61c2bd8a607785fdade72cce20e8faf1de7eee15 - **github.com/xyproto/algernon (go)** <= 1.17.6, fixed in 1.17.7: Algernon: Single-file mode unconditionally enables debug mode (CVE-2026-45728). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md ## Evidence - E1: https://bugbountylibrary.com/r/h1%3A685909.md - E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-r5mf-4r5x-q78f.md - E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-fwqx-8365-9983.md