PT-2026-44910 · Npm+1 · Axios+1
CVE-2026-44494
·
Published
2026-04-16
·
Updated
2026-07-31
CVSS v2.0
9.7
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:P |
Name of the Vulnerable Software and Affected Versions
axios versions 0.x through 1.x
Description
A prototype pollution gadget in the
lib/adapters/http.js component allows an attacker to escalate any Object.prototype pollution within an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This occurs because the HTTP adapter reads the config.proxy property via standard property access, which traverses the prototype chain. Since proxy is not present in the library's defaults, it can be injected via prototype pollution, causing the setProxy() function to route all HTTP traffic through an attacker-controlled proxy server.This allows a remote attacker to intercept, read, and modify all HTTP traffic, including authentication credentials, cookies, and request bodies. The attacker can also tamper with responses and perform internal network reconnaissance by viewing request URLs. This issue bypasses the
mergeConfig logic and is not addressed by the header sanitization patch in version 1.15.0.Recommendations
For versions 0.x through 1.x, use
hasOwnProperty when reading security-sensitive configuration properties in lib/adapters/http.js to ensure the property exists on the object itself rather than its prototype. Specifically, the config.proxy property should be accessed as: Object.prototype.hasOwnProperty.call(config, 'proxy') ? config.proxy : undefined.As a temporary mitigation, restrict access to the
config.proxy property or ensure that no dependencies in the application stack are vulnerable to prototype pollution.Exploit
Fix
DoS
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Confluence
Axios