{"cve":"CVE-2026-44494","nvd":{"published":"2026-06-11T17:16:33.313","modified":"2026-09-11T13:18:07.983","status":"Modified","description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8.7},"cwes":["CWE-441","CWE-1321","CWE-915"],"references":["https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:28964"],"products":["axios:axios"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-44494","score":0.01057,"percentile":0.64472,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-35jp-ww65-95wh","url":"https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh","summary":"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`","modified":"2026-09-10T03:51:04.268287831Z","packages":[{"ecosystem":"npm","name":"axios","purl":"pkg:npm/axios","ranges":[">=1.0.0 <1.16.0"],"fixed":["1.16.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}