Prototype Pollution Vulnerability in Axios HTTP Client by Axios
CVE-2026-44495

7HIGH

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
11 June 2026

What is CVE-2026-44495?

Axios, a popular promise-based HTTP client, has been identified with a vulnerability that allows prototype pollution via request configuration processing. Affected versions, ranging from 0.19.0 to just before 0.31.1 and 1.15.2, may be susceptible to inherited properties being treated as request options if an external prototype pollution vulnerability already targets the Object.prototype. This could potentially lead to unexpected behavior or security issues in applications relying on Axios for HTTP requests. To mitigate this vulnerability, users should update to Axios versions 0.31.1 or 1.15.2, where this issue has been resolved.

Affected Version(s)

axios >= 1.0.0, < 1.15.2 < 1.0.0, 1.15.2

axios >= 0.19.0, < 0.31.1 < 0.19.0, 0.31.1

References

https://github.com/axios/axios/security/advisories/GHSA-3...
x_refsource_CONFIRM

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.