{"id":"CVE-2026-44495","title":"Axios is a promise based HTTP client for the browser and Node.js","summary":"Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process h…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-94","CWE-1321","CWE-915"],"vendor":"axios","product":"axios","affected":["axios >= 0.19.0, < 0.31.1","axios >= 1.0.0, < 1.15.2","advanced_cluster_management_for_kubernetes < 2.13.9","advanced_cluster_security < 4.10.3","ansible_automation_platform = 2.6","data_grid = 8.6.2","developer_hub","discovery","openshift_container_platform","openshift_dev_spaces","openshift_service_mesh","openshift_virtualization","quay"],"patched":["axios 1.15.2","advanced_cluster_management_for_kubernetes 2.13.9","advanced_cluster_security 4.10.3"],"published":"2026-06-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T13:18:08.610","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27063","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:27944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29082","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30650","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:30651","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33155","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33163","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33173","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34160","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36108","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36611","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:36883","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40768","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40792","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:40795","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41055","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42142","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46903","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:53840","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54188","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:54555","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:59833","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44495.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-06-12T03:55:39.431622Z"},"epss":0.00854,"epssPercentile":0.56309,"ingestedAt":"2026-07-07T12:52:59.639Z","slug":"CVE-2026-44495","body":"## Overview\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.\n\n## Affected\n\n- `axios >= 0.19.0, < 0.31.1`\n- `axios >= 1.0.0, < 1.15.2`\n- `advanced_cluster_management_for_kubernetes < 2.13.9`\n- `advanced_cluster_security < 4.10.3`\n- `ansible_automation_platform = 2.6`\n- `data_grid = 8.6.2`\n- `developer_hub`\n- `discovery`\n- `openshift_container_platform`\n- `openshift_dev_spaces`\n- `openshift_service_mesh`\n- `openshift_virtualization`\n- `quay`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `axios 1.15.2`\n- `advanced_cluster_management_for_kubernetes 2.13.9`\n- `advanced_cluster_security 4.10.3`","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":38.5,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":201661,"id":"CVE-2026-44495","ts":1789399582255,"field":"exploit_available","old":"false","new":"true"},{"seq":200393,"id":"CVE-2026-44495","ts":1789397207809,"field":"exploit_available","old":"true","new":"false"},{"seq":198317,"id":"CVE-2026-44495","ts":1789391830393,"field":"exploit_available","old":"false","new":"true"},{"seq":196110,"id":"CVE-2026-44495","ts":1789383478202,"field":"exploit_available","old":"true","new":"false"},{"seq":195039,"id":"CVE-2026-44495","ts":1789380356125,"field":"exploit_available","old":"false","new":"true"},{"seq":193826,"id":"CVE-2026-44495","ts":1789378325701,"field":"exploit_available","old":"true","new":"false"},{"seq":192613,"id":"CVE-2026-44495","ts":1789376303349,"field":"exploit_available","old":"false","new":"true"},{"seq":191400,"id":"CVE-2026-44495","ts":1789373238664,"field":"exploit_available","old":"true","new":"false"},{"seq":190185,"id":"CVE-2026-44495","ts":1789369195492,"field":"exploit_available","old":"false","new":"true"},{"seq":188972,"id":"CVE-2026-44495","ts":1789368098458,"field":"exploit_available","old":"true","new":"false"},{"seq":187755,"id":"CVE-2026-44495","ts":1789365052520,"field":"exploit_available","old":"false","new":"true"},{"seq":186542,"id":"CVE-2026-44495","ts":1789363090934,"field":"exploit_available","old":"true","new":"false"},{"seq":185328,"id":"CVE-2026-44495","ts":1789361011175,"field":"exploit_available","old":"false","new":"true"},{"seq":184115,"id":"CVE-2026-44495","ts":1789358002428,"field":"exploit_available","old":"true","new":"false"},{"seq":182366,"id":"CVE-2026-44495","ts":1789354153432,"field":"exploit_available","old":"false","new":"true"},{"seq":181159,"id":"CVE-2026-44495","ts":1789352996189,"field":"exploit_available","old":"true","new":"false"},{"seq":179952,"id":"CVE-2026-44495","ts":1789350064385,"field":"exploit_available","old":"false","new":"true"},{"seq":178745,"id":"CVE-2026-44495","ts":1789347931280,"field":"exploit_available","old":"true","new":"false"},{"seq":177538,"id":"CVE-2026-44495","ts":1789346216831,"field":"exploit_available","old":"false","new":"true"},{"seq":176331,"id":"CVE-2026-44495","ts":1789342836210,"field":"exploit_available","old":"true","new":"false"},{"seq":175785,"id":"CVE-2026-44495","ts":1789338620477,"field":"exploit_available","old":"false","new":"true"},{"seq":175655,"id":"CVE-2026-44495","ts":1789338462155,"field":"exploit_available","old":"true","new":"false"},{"seq":174450,"id":"CVE-2026-44495","ts":1789334640765,"field":"exploit_available","old":"false","new":"true"},{"seq":173245,"id":"CVE-2026-44495","ts":1789333308642,"field":"exploit_available","old":"true","new":"false"},{"seq":172059,"id":"CVE-2026-44495","ts":1789330938582,"field":"exploit_available","old":"false","new":"true"},{"seq":170873,"id":"CVE-2026-44495","ts":1789328456112,"field":"exploit_available","old":"true","new":"false"},{"seq":169668,"id":"CVE-2026-44495","ts":1789326963914,"field":"exploit_available","old":"false","new":"true"},{"seq":168463,"id":"CVE-2026-44495","ts":1789323527952,"field":"exploit_available","old":"true","new":"false"},{"seq":167258,"id":"CVE-2026-44495","ts":1789319421717,"field":"exploit_available","old":"false","new":"true"},{"seq":166053,"id":"CVE-2026-44495","ts":1789318389165,"field":"exploit_available","old":"true","new":"false"},{"seq":164848,"id":"CVE-2026-44495","ts":1789315609905,"field":"exploit_available","old":"false","new":"true"},{"seq":163643,"id":"CVE-2026-44495","ts":1789313327439,"field":"exploit_available","old":"true","new":"false"},{"seq":162438,"id":"CVE-2026-44495","ts":1789311749792,"field":"exploit_available","old":"false","new":"true"},{"seq":161233,"id":"CVE-2026-44495","ts":1789308351654,"field":"exploit_available","old":"true","new":"false"},{"seq":160738,"id":"CVE-2026-44495","ts":1789304278691,"field":"exploit_available","old":"false","new":"true"},{"seq":158576,"id":"CVE-2026-44495","ts":1789299344968,"field":"exploit_available","old":"true","new":"false"},{"seq":157540,"id":"CVE-2026-44495","ts":1789296501961,"field":"exploit_available","old":"false","new":"true"},{"seq":156335,"id":"CVE-2026-44495","ts":1789294453084,"field":"exploit_available","old":"true","new":"false"},{"seq":155130,"id":"CVE-2026-44495","ts":1789292699418,"field":"exploit_available","old":"false","new":"true"},{"seq":153925,"id":"CVE-2026-44495","ts":1789289429908,"field":"exploit_available","old":"true","new":"false"},{"seq":152575,"id":"CVE-2026-44495","ts":1789281313335,"field":"exploit_available","old":"false","new":"true"},{"seq":150137,"id":"CVE-2026-44495","ts":1789275892760,"field":"exploit_available","old":"true","new":"false"},{"seq":149104,"id":"CVE-2026-44495","ts":1789273612903,"field":"exploit_available","old":"false","new":"true"},{"seq":148071,"id":"CVE-2026-44495","ts":1789270951121,"field":"exploit_available","old":"true","new":"false"},{"seq":146111,"id":"CVE-2026-44495","ts":1789269206277,"field":"exploit_available","old":"false","new":"true"},{"seq":145014,"id":"CVE-2026-44495","ts":1789266178271,"field":"exploit_available","old":"true","new":"false"},{"seq":143918,"id":"CVE-2026-44495","ts":1789262507797,"field":"exploit_available","old":"false","new":"true"},{"seq":142754,"id":"CVE-2026-44495","ts":1789261270279,"field":"exploit_available","old":"true","new":"false"},{"seq":141590,"id":"CVE-2026-44495","ts":1789258656132,"field":"exploit_available","old":"false","new":"true"},{"seq":140392,"id":"CVE-2026-44495","ts":1789256463616,"field":"exploit_available","old":"true","new":"false"}]}