By vendor

Axios vulnerabilities

Known CVEs affecting Axios products, prioritized by severity, with SEC.co remediation and detection guidance.

7 published vulnerabilities

• CVE-2026-44494HIGH 8.7

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability that allows attackers to intercept and modify all network traffic from an affected application. An attacker who can pollute an application's prototype chain (through a separate vulnerability in a dependency) can inject a malicious proxy configuration into Axios. Once injected, Axios will route all HTTP requests—including those carrying authentication credentials—through the attacker's proxy server, enabling complete man-in-the-middle attacks. This affects Axios versions 1.0.0 through 1.15.x; upgrading to 1.16.0 or later eliminates the vulnerability.

• CVE-2026-44486HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript, has a credential leakage vulnerability in its Node.js implementation. When your application uses Axios to make requests through an authenticated proxy, the library can accidentally include proxy login credentials in subsequent requests if it follows a redirect to a different server. This happens because Axios retains the Proxy-Authorization header even when the redirected request no longer routes through the original proxy. Browser-based Axios applications are unaffected; only Node.js deployments with automatic redirect handling and proxy authentication are vulnerable.

• CVE-2026-44487HIGH 7.5

  Axios, a widely-used HTTP client library for Node.js and browsers, has a credential leakage vulnerability in its redirect-handling logic. When an application makes an HTTP request through an authenticated proxy and then follows a redirect to a destination that no longer requires the proxy, Axios may mistakenly send the proxy's authentication credentials to the final destination. An attacker controlling or observing that final destination could capture credentials intended only for the proxy, potentially gaining unauthorized access to internal proxy infrastructure. This flaw affects Axios versions before 0.32.0 and 1.16.0.

• CVE-2026-44488HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability in versions 1.7.0 through 1.15.x that bypasses size limits when using the fetch adapter. When developers configure maxContentLength or maxBodyLength to restrict how much data can be sent or received, those limits are ignored if the fetch adapter is active. An attacker or compromised server can exploit this to send oversized responses that exhaust application resources, or an application forwarding untrusted request bodies may inadvertently process larger payloads than intended. The vulnerability is resolved in Axios 0.32.0 and 1.16.0.

• CVE-2026-44496HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability in how it processes XSRF (cross-site request forgery) cookie names. When building a security check, the library doesn't properly escape special characters used in regular expressions, allowing an attacker to craft a malicious cookie name that triggers expensive computational operations. In browser environments, this causes the application to freeze or become unresponsive while processing requests. The vulnerability does not affect Node.js server applications, React Native, or web workers. Versions 0.32.0 and later on the 0.x line and 1.16.0 and later on the 1.x line resolve this issue.

• CVE-2026-44490MEDIUM 4.8

  Axios, a widely-used HTTP client for JavaScript environments, contains two prototype-pollution vulnerabilities that can be exploited when an upstream dependency (such as lodash) has already polluted JavaScript's Object.prototype. An attacker cannot directly trigger these gadgets, but if your application uses a vulnerable dependency alongside axios, malicious code or data flowing through your supply chain could cause axios to either leak polluted properties in HTTP headers or crash on every request with a TypeError. Versions before 0.32.0 (for the 0.x line) and before 1.16.0 (for the 1.x line) are affected.

• CVE-2026-44489LOW 3.7

  Axios, a widely-used HTTP client library for JavaScript, contains a prototype pollution vulnerability in its configuration merging logic. When a developer uses Axios with a proxy configuration, an attacker can pollute the Object.prototype to inject fake username and password values. These polluted values are then automatically included in Proxy-Authorization headers sent with every proxied HTTP request, potentially leaking attacker-controlled credentials or disrupting authentication. The vulnerability affects Axios versions 1.15.2 through 1.15.x and is resolved in version 1.16.0.