---
id: CVE-2026-62979
title: 'jack: upstream error responses expose backend and peer credentials'
summary: >-
  jack lets users share media libraries through their Radarr/Sonarr stack,
  peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw
  `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches
  outbound request …
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-209
vendor: roziscoding
product: jack
affected:
  - jack < 0.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T21:18:23.166510Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:12:34.837Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62979'
references:
  - url: >-
      https://github.com/roziscoding/jack/security/advisories/GHSA-8gw5-7585-4997
    label: >-
      https://github.com/roziscoding/jack/security/advisories/GHSA-8gw5-7585-4997
  - url: >-
      https://github.com/roziscoding/jack/commit/2b296b5137acca476f34a23b692dd8c04ae1f148
    label: >-
      https://github.com/roziscoding/jack/commit/2b296b5137acca476f34a23b692dd8c04ae1f148
  - url: 'https://github.com/roziscoding/jack/releases/tag/v0.1.0'
    label: 'https://github.com/roziscoding/jack/releases/tag/v0.1.0'
tags:
  - cve.org
epss: 0.00355
epssPercentile: 0.29408
ingestedAt: '2026-11-05T16:24:31.472Z'
---

## Overview

jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.

## Affected

- `jack < 0.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.