{"record":{"id":"a12d553cd13252a6","repo":"denoland/deno","slug":"setting-the-node-debug-environment-variable-to","errorCode":null,"errorMessage":"Setting the NODE_DEBUG environment variable to '${StringPrototypeToLowerCase(set)}' can expose sensitive data (such as passwords, tokens and authentication headers) in the resulting log.","messagePattern":"Setting the NODE_DEBUG environment variable to '(.+?)' can expose sensitive data \\(such as passwords, tokens and authentication headers\\) in the resulting log\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"ext/node/polyfills/internal/util/debuglog.ts","lineNumber":64,"sourceCode":"        \"*\",\n        \".*\",\n      ),\n      \",\",\n      \"$|^\",\n    );\n    const debugEnvRegex = new SafeRegExp(`^${debugEnv}$`, \"i\");\n    testEnabled = (str) => RegExpPrototypeExec(debugEnvRegex, str) !== null;\n  } else {\n    testEnabled = () => false;\n  }\n}\n\n// Emits warning when user sets\n// NODE_DEBUG=http or NODE_DEBUG=http2.\nfunction emitWarningIfNeeded(set: string) {\n  if (\"HTTP\" === set || \"HTTP2\" === set) {\n    // deno-lint-ignore no-console\n    console.warn(\n      \"Setting the NODE_DEBUG environment variable \" +\n        \"to '\" + StringPrototypeToLowerCase(set) + \"' can expose sensitive \" +\n        \"data (such as passwords, tokens and authentication headers) \" +\n        \"in the resulting log.\",\n    );\n  }\n}\n\nconst noop = () => {};\n\nfunction debuglogImpl(\n  enabled: boolean,\n  set: string,\n): (...args: unknown[]) => void {\n  if (debugImpls[set] === undefined) {\n    if (enabled) {\n      emitWarningIfNeeded(set);\n      debugImpls[set] = function debug(msg, ...args: unknown[]) {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/util/debuglog.ts#L46-L82","documentation":"node:util's debuglog initialization in Deno mirrors Node's warning for NODE_DEBUG=http/http2: enabling debug logging for the HTTP layers prints request/response internals, including URLs, headers, and potentially Authorization tokens (ext/node/polyfills/internal/util/debuglog.ts:57-66). It is a privacy/security heads-up, not a functional problem; the debug logging still happens if you keep the variable set.","triggerScenarios":"The NODE_DEBUG environment variable contains http or http2 (matching is case-insensitive, including inside comma-separated lists like NODE_DEBUG=http,net), and node code initializes debuglog for those sections. The check is exact section matching: 'HTTP' === set || 'HTTP2' === set after uppercase normalization.","commonSituations":"NODE_DEBUG=http exported in .bashrc/.zshrc, Dockerfiles, or CI defaults to debug fetch/undici-style issues and never removed; CI logs captured and shared with embedded Authorization/Cookie headers; pairing NODE_DEBUG with token-authenticated internal services.","solutions":["Remove http and http2 from NODE_DEBUG and keep only what you need (e.g., NODE_DEBUG=net,stream)","Scope NODE_DEBUG to a single debug invocation (NODE_DEBUG=http deno run app.js) instead of exporting it globally","If HTTP tracing is genuinely required, redact Authorization/Cookie/set-cookie headers from logs before they are stored or shared","Audit CI containers and env files for stale NODE_DEBUG values"],"exampleFix":"# before\nexport NODE_DEBUG=http,http2,net\ndeno run app.js   # warning: http/http2 debug can leak credentials\n\n# after\nNODE_DEBUG=net,stream deno run app.js   # non-header-dumping sections only","handlingStrategy":"validation","validationCode":"// scrub http/http2 from NODE_DEBUG before node modules initialize debuglog\nconst parts = (Deno.env.get(\"NODE_DEBUG\") ?? \"\")\n  .split(\",\")\n  .map((s) => s.trim())\n  .filter((s) => s && s.toLowerCase() !== \"http\" && s.toLowerCase() !== \"http2\");\nif (parts.length) Deno.env.set(\"NODE_DEBUG\", parts.join(\",\"));\nelse Deno.env.delete(\"NODE_DEBUG\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never export NODE_DEBUG=http in shells, Dockerfiles, or CI defaults; scope it to one command","Redact Authorization/Cookie/set-cookie headers from any pipeline that captures debug output","Audit CI secrets and env files for stale NODE_DEBUG values periodically"],"tags":["node-compat","debug-logging","security","environment-variables","headers"],"backgroundTag":"sensitive-data-in-logs","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}