{"id":"CVE-2026-44487","title":"Axios is a promise based HTTP client for the browser and Node.js","summary":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. Th…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-201"],"vendor":"axios","product":"axios","affected":["axios < 0.32.0","axios >= 1.0.0, < 1.16.0"],"patched":["axios 1.16.0"],"published":"2026-06-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T13:18:06.053","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27063","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29082","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29864","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30650","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33155","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33163","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33173","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34525","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34527","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34530","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36611","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36883","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40768","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40792","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40795","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41055","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42085","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42142","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46903","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54188","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54206","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44487","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487948","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-11T18:17:25.366630Z"},"scores":{"nvd":7.5,"cna":8.2},"epss":0.00689,"epssPercentile":0.51321,"ingestedAt":"2026-07-07T12:52:59.630Z","slug":"CVE-2026-44487","body":"## Overview\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.\n\n## Affected\n\n- `axios < 0.32.0`\n- `axios >= 1.0.0, < 1.16.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `axios 1.16.0`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201657,"id":"CVE-2026-44487","ts":1789399582203,"field":"exploit_available","old":"false","new":"true"},{"seq":200389,"id":"CVE-2026-44487","ts":1789397207779,"field":"exploit_available","old":"true","new":"false"},{"seq":198313,"id":"CVE-2026-44487","ts":1789391830365,"field":"exploit_available","old":"false","new":"true"},{"seq":196106,"id":"CVE-2026-44487","ts":1789383478174,"field":"exploit_available","old":"true","new":"false"},{"seq":195035,"id":"CVE-2026-44487","ts":1789380356097,"field":"exploit_available","old":"false","new":"true"},{"seq":193822,"id":"CVE-2026-44487","ts":1789378325667,"field":"exploit_available","old":"true","new":"false"},{"seq":192609,"id":"CVE-2026-44487","ts":1789376303323,"field":"exploit_available","old":"false","new":"true"},{"seq":191396,"id":"CVE-2026-44487","ts":1789373238633,"field":"exploit_available","old":"true","new":"false"},{"seq":190181,"id":"CVE-2026-44487","ts":1789369195466,"field":"exploit_available","old":"false","new":"true"},{"seq":188968,"id":"CVE-2026-44487","ts":1789368098429,"field":"exploit_available","old":"true","new":"false"},{"seq":187751,"id":"CVE-2026-44487","ts":1789365052493,"field":"exploit_available","old":"false","new":"true"},{"seq":186538,"id":"CVE-2026-44487","ts":1789363090905,"field":"exploit_available","old":"true","new":"false"},{"seq":185324,"id":"CVE-2026-44487","ts":1789361011149,"field":"exploit_available","old":"false","new":"true"},{"seq":184111,"id":"CVE-2026-44487","ts":1789358002397,"field":"exploit_available","old":"true","new":"false"},{"seq":182362,"id":"CVE-2026-44487","ts":1789354153406,"field":"exploit_available","old":"false","new":"true"},{"seq":181155,"id":"CVE-2026-44487","ts":1789352996161,"field":"exploit_available","old":"true","new":"false"},{"seq":179948,"id":"CVE-2026-44487","ts":1789350064355,"field":"exploit_available","old":"false","new":"true"},{"seq":178741,"id":"CVE-2026-44487","ts":1789347931253,"field":"exploit_available","old":"true","new":"false"},{"seq":177534,"id":"CVE-2026-44487","ts":1789346216802,"field":"exploit_available","old":"false","new":"true"},{"seq":176327,"id":"CVE-2026-44487","ts":1789342836181,"field":"exploit_available","old":"true","new":"false"},{"seq":175781,"id":"CVE-2026-44487","ts":1789338620446,"field":"exploit_available","old":"false","new":"true"},{"seq":175651,"id":"CVE-2026-44487","ts":1789338462127,"field":"exploit_available","old":"true","new":"false"},{"seq":174446,"id":"CVE-2026-44487","ts":1789334640737,"field":"exploit_available","old":"false","new":"true"},{"seq":173241,"id":"CVE-2026-44487","ts":1789333307985,"field":"exploit_available","old":"true","new":"false"},{"seq":172055,"id":"CVE-2026-44487","ts":1789330938556,"field":"exploit_available","old":"false","new":"true"},{"seq":170869,"id":"CVE-2026-44487","ts":1789328456084,"field":"exploit_available","old":"true","new":"false"},{"seq":169664,"id":"CVE-2026-44487","ts":1789326963884,"field":"exploit_available","old":"false","new":"true"},{"seq":168459,"id":"CVE-2026-44487","ts":1789323527923,"field":"exploit_available","old":"true","new":"false"},{"seq":167254,"id":"CVE-2026-44487","ts":1789319421691,"field":"exploit_available","old":"false","new":"true"},{"seq":166049,"id":"CVE-2026-44487","ts":1789318389112,"field":"exploit_available","old":"true","new":"false"},{"seq":164844,"id":"CVE-2026-44487","ts":1789315609877,"field":"exploit_available","old":"false","new":"true"},{"seq":163639,"id":"CVE-2026-44487","ts":1789313327407,"field":"exploit_available","old":"true","new":"false"},{"seq":162434,"id":"CVE-2026-44487","ts":1789311749764,"field":"exploit_available","old":"false","new":"true"},{"seq":161229,"id":"CVE-2026-44487","ts":1789308351617,"field":"exploit_available","old":"true","new":"false"},{"seq":160734,"id":"CVE-2026-44487","ts":1789304278654,"field":"exploit_available","old":"false","new":"true"},{"seq":158572,"id":"CVE-2026-44487","ts":1789299344941,"field":"exploit_available","old":"true","new":"false"},{"seq":157536,"id":"CVE-2026-44487","ts":1789296501936,"field":"exploit_available","old":"false","new":"true"},{"seq":156331,"id":"CVE-2026-44487","ts":1789294453054,"field":"exploit_available","old":"true","new":"false"},{"seq":155126,"id":"CVE-2026-44487","ts":1789292699392,"field":"exploit_available","old":"false","new":"true"},{"seq":153921,"id":"CVE-2026-44487","ts":1789289429880,"field":"exploit_available","old":"true","new":"false"},{"seq":152571,"id":"CVE-2026-44487","ts":1789281313304,"field":"exploit_available","old":"false","new":"true"},{"seq":150133,"id":"CVE-2026-44487","ts":1789275892732,"field":"exploit_available","old":"true","new":"false"},{"seq":149100,"id":"CVE-2026-44487","ts":1789273612870,"field":"exploit_available","old":"false","new":"true"},{"seq":148067,"id":"CVE-2026-44487","ts":1789270951093,"field":"exploit_available","old":"true","new":"false"},{"seq":146107,"id":"CVE-2026-44487","ts":1789269206250,"field":"exploit_available","old":"false","new":"true"},{"seq":145010,"id":"CVE-2026-44487","ts":1789266178241,"field":"exploit_available","old":"true","new":"false"},{"seq":143914,"id":"CVE-2026-44487","ts":1789262507764,"field":"exploit_available","old":"false","new":"true"},{"seq":142750,"id":"CVE-2026-44487","ts":1789261270252,"field":"exploit_available","old":"true","new":"false"},{"seq":141586,"id":"CVE-2026-44487","ts":1789258656107,"field":"exploit_available","old":"false","new":"true"},{"seq":140388,"id":"CVE-2026-44487","ts":1789256463584,"field":"exploit_available","old":"true","new":"false"}]}