Log in Start free

Vulnerability · Published Jun 11, 2026 · Assigned by GitHub_M

CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

High 7.5

In plain English

A high-severity security flaw in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-axiosno fix listedDEBIAN-CVE-2026-44487
Debian:13node-axiosno fix listedDEBIAN-CVE-2026-44487
Debian:14node-axios1.16.0-1DEBIAN-CVE-2026-44487
Ubuntu:25.10node-axiosno fix listedUBUNTU-CVE-2026-44487
Ubuntu:26.10node-axiosno fix listedUBUNTU-CVE-2026-44487
npmaxios0.32.0GHSA-p92q-9vqr-4j8v
npmaxios1.16.0GHSA-p92q-9vqr-4j8v

Affected products (as reported)

VendorProductVersions
axios axios >= 1.0.0, < 1.16.0< 0.32.0

Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References