Code Injection Vulnerability in Axios HTTP Client
CVE-2026-44489

3.7LOW

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
11 June 2026

What is CVE-2026-44489?

A vulnerability exists in versions of the Axios HTTP client prior to 1.16.0, where the utils.merge() function creates nested objects that could be exploited. The problematic setProxy() function reads proxy credentials without proper checks, leading to potential injection of attacker-controlled credentials into HTTP requests when Object.prototype is compromised. This issue could allow unauthorized access due to manipulated Proxy-Authorization headers. The vulnerability was addressed in version 1.16.0, enhancing security by implementing necessary checks.

Affected Version(s)

axios 1.15.2

References

https://github.com/axios/axios/security/advisories/GHSA-6...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.