CVE-2026-44487

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json

https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v

https://bugzilla.redhat.com/show_bug.cgi?id=2487948

https://access.redhat.com/security/cve/CVE-2026-44487

https://access.redhat.com/errata/RHSA-2026:43052

https://access.redhat.com/errata/RHSA-2026:42796

https://access.redhat.com/errata/RHSA-2026:42146

https://access.redhat.com/errata/RHSA-2026:42142

https://access.redhat.com/errata/RHSA-2026:42085

https://access.redhat.com/errata/RHSA-2026:42078

https://access.redhat.com/errata/RHSA-2026:41951

https://access.redhat.com/errata/RHSA-2026:41928

https://access.redhat.com/errata/RHSA-2026:41066

https://access.redhat.com/errata/RHSA-2026:41064

https://access.redhat.com/errata/RHSA-2026:41055

https://access.redhat.com/errata/RHSA-2026:41031

https://access.redhat.com/errata/RHSA-2026:40795

https://access.redhat.com/errata/RHSA-2026:40792

https://access.redhat.com/errata/RHSA-2026:40768

https://access.redhat.com/errata/RHSA-2026:40262

https://access.redhat.com/errata/RHSA-2026:36883

https://access.redhat.com/errata/RHSA-2026:36882

https://access.redhat.com/errata/RHSA-2026:36820

https://access.redhat.com/errata/RHSA-2026:36754

https://access.redhat.com/errata/RHSA-2026:36611

https://access.redhat.com/errata/RHSA-2026:34530

https://access.redhat.com/errata/RHSA-2026:34527

https://access.redhat.com/errata/RHSA-2026:34525

https://access.redhat.com/errata/RHSA-2026:34374

https://access.redhat.com/errata/RHSA-2026:33574

https://access.redhat.com/errata/RHSA-2026:33183

https://access.redhat.com/errata/RHSA-2026:33173

https://access.redhat.com/errata/RHSA-2026:33163

https://access.redhat.com/errata/RHSA-2026:33160

https://access.redhat.com/errata/RHSA-2026:33155

https://access.redhat.com/errata/RHSA-2026:30651

https://access.redhat.com/errata/RHSA-2026:30650

https://access.redhat.com/errata/RHSA-2026:29864

https://access.redhat.com/errata/RHSA-2026:29197

https://access.redhat.com/errata/RHSA-2026:29082

https://access.redhat.com/errata/RHSA-2026:28964

https://access.redhat.com/errata/RHSA-2026:27063

https://access.redhat.com/errata/RHSA-2026:27044

https://access.redhat.com/errata/RHSA-2026:26234

https://access.redhat.com/errata/RHSA-2026:20938

https://access.redhat.com/errata/RHSA-2026:20889

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS