Stack Traces and Error Details Shown to Users

What Is This Vulnerability?

When an application displays raw error messages, stack traces, or exception details to end users, it leaks internal information about the tech stack, file paths, database structure, and third-party services. This information disclosure helps attackers identify specific software versions, vulnerable libraries, and potential attack vectors.

Why It Happens

Applications in development are configured to display verbose errors for debugging. When deployed to production without proper error handling, these detailed messages reach end users. Many frameworks default to showing full stack traces, and developers forget to configure custom error handlers. Unhandled exceptions in API responses also leak implementation details.

Example Code

app.get("/api/users/:id", async (req, res) => {
  try {
    const user = await db.query(
      "SELECT * FROM users WHERE id = $1",
      [req.params.id]
    );
    res.json(user.rows[0]);
  } catch (error) {
    res.status(500).json({
      error: error.message,
      stack: error.stack,
      query: error.query,
    });
  }
});

import { randomUUID } from "crypto";
import { logger } from "./logger";

app.get("/api/users/:id", async (req, res) => {
  try {
    const user = await db.query(
      "SELECT * FROM users WHERE id = $1",
      [req.params.id]
    );
    res.json(user.rows[0]);
  } catch (error) {
    const errorId = randomUUID();
    logger.error({ errorId, error, path: req.path });
    res.status(500).json({
      error: "An internal error occurred",
      errorId,
    });
  }
});

How Hackers Exploit It

Attackers deliberately send malformed inputs to trigger errors and inspect the responses. Stack traces reveal framework versions, ORM queries expose database table and column names, and file paths disclose the server OS and directory structure. This reconnaissance helps attackers choose targeted exploits, craft SQL injection payloads, and identify vulnerable dependency versions.

How to Fix It

Implement a global error handler that catches all exceptions and returns generic error messages to clients. Log detailed error information server-side with a correlation ID that can be referenced for debugging. Use custom error pages for web applications. In APIs, always return structured error responses with safe messages and a trace ID, never raw exceptions.

Frequently Asked Questions