Node.js Module axios 0.19.x < 0.31.1 / 1.x < 1.15.2 Prototype Pollution Credential Theft (CVE-2026-44495)

high Nessus Plugin ID 318802

Synopsis

A module in the Node.js JavaScript run-time environment is affected by a credential theft vulnerability.

Description

The version of the axios Node.js module installed on the remote host is 0.19.x prior to 0.31.1 or 1.x prior to 1.15.2. It is, therefore, affected by the following vulnerability:

- A prototype pollution gadget in the config merge and response transformation pipeline allows credential theft and response hijacking. The mergeConfig function reads config properties via standard property access which traverses the prototype chain. When Object.prototype.transformResponse is polluted with a function, it overrides the default JSON response parser for every request. The injected function executes with this set to config, exposing auth.username, auth.password, request URL, and all headers.
(CVE-2026-44495)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to axios version 0.31.1 / 1.15.2 or later.

Plugin Details

Severity: High

ID: 318802

File Name: nodejs_module_axios_GHSA-3g43-6gmg-66jw.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 6/5/2026

Updated: 6/5/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:P

CVSS Score Source: CVE-2026-44495

CVSS v3

Risk Factor: High

Base Score: 7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Vulnerability Information

CPE: cpe:/a:axios:axios

Required KB Items: installed_sw/Node.js, Host/nodejs/modules/enumerated

Patch Publication Date: 5/29/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-44495

IAVA: 2026-A-0534

Detections

Analytics