Prototype Pollution Vulnerability in Axios HTTP Client

CVE-2026-44494

What is CVE-2026-44494?

The Axios HTTP client, used for handling HTTP requests in JavaScript applications, is susceptible to a Prototype Pollution vulnerability from versions 1.0.0 to before 1.16.0. This flaw allows attackers to inject malicious properties into an object’s prototype chain, enabling a full Man-in-the-Middle (MITM) attack on HTTP requests. When exploited, an attacker can intercept, read, and modify all HTTP traffic in the application, including sensitive authentication credentials, by routing requests through a malicious proxy server. This critical security issue is addressed in Axios version 1.16.0.

References