Prototype Pollution in Axios HTTP Client Software
CVE-2026-44490

4.8MEDIUM

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
11 June 2026

What is CVE-2026-44490?

The Axios HTTP client, used both in browser and Node.js environments, has a security flaw that allows for prototype pollution through read-side gadgets. This issue arises when Object.prototype is compromised by an upstream dependency, leading Axios to inadvertently adopt polluted values. Specifically, during the merging of headers and the evaluation of property descriptors, the library can expose sensitive data or trigger unexpected behavior in every request made. Versions 0.32.0 and 1.16.0 address this vulnerability by improving the handling of object properties, thus preventing the exploitation of the affected functionalities.

Affected Version(s)

axios >= 1.0.0, < 1.16.0 < 1.0.0, 1.16.0

axios < 0.32.0 < 0.32.0

References

https://github.com/axios/axios/security/advisories/GHSA-8...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.