Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios's     Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific     proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through     an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under     affected redirect shapes, the final origin can receive the proxy credential that was intended only for the     outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0. (CVE-2026-44487)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s
    Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific
    proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through
    an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under
    affected redirect shapes, the final origin can receive the proxy credential that was intended only for the
    outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0. (CVE-2026-44487)

ID	Name	Product	Family	Severity
320766	Linux Distros Unpatched Vulnerability : CVE-2026-44487	Nessus	Misc.	high
442642	SCA: security update for axios (GHSA-p92q-9vqr-4j8v)	Tenable Cloud Security	SCA Checks	high
442642	SCA: security update for axios (GHSA-p92q-9vqr-4j8v)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-44487

high

Tenable Plugins

high

high

high