LiveActive security incident?Get immediate response
CVE Record

CVE-2026-44487: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Axios, a popular JavaScript library used to make web requests, had a flaw in its Node.js code that could leak the password for a company's outbound proxy server to an unrelated external website during certain redirects. Anyone using older Axios versions with an authenticated proxy could unintentionally send those credentials to an outside party.

Executive priority

Priority: elevated but not emergency. Schedule library upgrades in the next patch cycle, rotate proxy credentials used with older Axios, and confirm no sensitive proxy passwords were exposed to external hosts.

Technical view

In Axios versions before 0.32.0 and 1.16.0, the Node.js HTTP adapter forwards the Proxy-Authorization header when a request routed through an authenticated HTTP proxy is redirected to a destination that is not proxied. The final origin server receives the proxy credential, exposing information that should have stayed on the outbound-proxy leg. Fixed in 0.32.0 and 1.16.0.

Likely exposure

Node.js services and tooling using Axios less than 0.32.0 or 1.x below 1.16.0, configured with an authenticated HTTP proxy and following redirects, especially where redirect targets may be attacker-influenced or point to third-party origins.

Exploitation context

Not listed on CISA KEV and no public exploitation is cited in the provided sources. CVSS 4.0 base 8.2 reflects network-attack surface with a passive-attacker/redirect precondition. Impact is confidentiality of proxy credentials only; no code execution or integrity impact is described.

Researcher notes

CWE-201 (Insertion of Sensitive Information Into Sent Data). Trigger requires an authenticated HTTP proxy plus a redirect to a non-proxied origin; scope is limited to leakage of Proxy-Authorization to the final origin. Numerous Red Hat errata indicate broad ecosystem exposure via bundled components. KEV status false as of source bundle.

Mitigation direction

  • Upgrade Axios to 0.32.0 or 1.16.0 (or later) across all Node.js services and build tooling.
  • Apply relevant Red Hat RHSA errata for platform packages that bundle Axios.
  • Rotate any proxy credentials that may have been sent through redirect-following Axios clients.
  • Restrict or disable automatic redirect following for requests carrying Proxy-Authorization until patched.
  • Use dedicated, least-privileged proxy accounts and monitor for unexpected credential use.

Validation and detection

  • Inventory Node.js apps and dependencies for axios versions using npm ls axios or SCA tooling.
  • Confirm patched versions (>=0.32.0 on 0.x, >=1.16.0 on 1.x) are deployed in production.
  • Review proxy configurations to identify services using Proxy-Authorization headers with Axios.
  • Check egress logs for outbound requests that redirected off-proxy while patches were pending.
  • Verify vendor advisories (GitHub GHSA-p92q-9vqr-4j8v, Red Hat RHSAs) match deployed package builds.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-201: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-44487 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
5Timeline events
2ADP providers
30Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——GitHub_M
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

8.2High
CVSS 4.0 vector shape for CVE-2026-44487Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
redhat-SADPaxios: Axios: Information disclosure of proxy credentials via redirect flows
other:Red Hat severity ratingcvssV3_1
  • 2026-06-11T17:01:34.091Z: Reported to Red Hat.
  • 2026-06-11T15:38:25.150Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
axiosaxios>= 1.0.0, < 1.16.0, < 0.32.0Listed
Weakness

CWE details

CWE-201

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-201 · source CWE mapping

Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs