InfoSec Signals™
Sign InStart Free
Back to CVE records
High 8.2Published Jun 11, 2026

CVE-2026-44487Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Updated under an hour ago ()

Does this affect you?

It affects axios and 32 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

CVSS
8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-201
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
GitHub_M
NVD analysis
Modified
Record last updated
Sep 11, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
axios axios
axios:axios (from the name)
from 1.0.0, < 1.16.0; before 0.32.0
CNA record
7.13
CISA ADP
from 0:2.5.20260715-1.el8ap not affected
CISA ADP
Red Hat Red Hat Data Grid 8.6.2
redhat:jboss_data_grid
8
CISA ADP
from 1784312384 not affected
CISA ADP
from 1783350952 not affected
CISA ADP
Red Hat Red Hat Advanced Cluster Security 4.9
redhat:advanced_cluster_security
from 1779371594 not affected
CISA ADP
from 1783448184 not affected
CISA ADP
from 1782166952 not affected
CISA ADP
from 1783690532 not affected
CISA ADP
Red Hat Red Hat Migration Toolkit for Applications 8.1
redhat:migration_toolkit_applications
from 1785169013 not affected
CISA ADP
from 1787347991 not affected
CISA ADP
from 1786511587 not affected
CISA ADP
from 1782498475 not affected
CISA ADP
from 1781937133 not affected
CISA ADP
from 1783750447 not affected
CISA ADP
from 1781174698 not affected
CISA ADP
Red Hat Red Hat Trusted Artifact Signer 1.3
redhat:trusted_artifact_signer
from 1784105894 not affected
CISA ADP
Red Hat Cryostat 4
redhat:cryostat
4
CISA ADP
Red Hat Gatekeeper 3
redhat:gatekeeper
3
CISA ADP
Red Hat Network Observability Operator
redhat:network_observ_optr
1
CISA ADP
Red Hat OpenShift Pipelines
redhat:openshift_pipelines
1
CISA ADP
2
CISA ADP
4
CISA ADP
4
CISA ADP
3
CISA ADP
0
CISA ADP
Red Hat Red Hat Enterprise Linux 8
redhat:enterprise_linux
8
CISA ADP
3
CISA ADP
Red Hat Red Hat Fuse 7
redhat:jboss_fuse
7
CISA ADP
Red Hat Red Hat OpenShift Virtualization 4
redhat:container_native_virtualization
4
CISA ADP
Red Hat Red Hat Trusted Profile Analyzer
redhat:trusted_profile_analyzer
2
CISA ADP
2
CISA ADP
axios axios
axios:axios
before 0.32.0; from 1.0.0 before 1.16.0
NVD

References

  • x-refsource-confirm, exploit, mitigation, vendor-advisory

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.