Node.js Module axios 1.x < 1.16.0 Prototype Pollution Proxy MITM (CVE-2026-44494)

high Nessus Plugin ID 318803

Synopsis

A module in the Node.js JavaScript run-time environment is affected by a man-in-the-middle vulnerability.

Description

The version of the axios Node.js module installed on the remote host is 1.x prior to 1.16.0. It is, therefore, affected by the following vulnerability:

- A prototype pollution gadget in config.proxy allows any Object.prototype pollution in the application's dependency tree to be escalated into a full man-in-the-middle attack. The HTTP adapter reads config.proxy via standard property access which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server, enabling interception of credentials and response tampering. (CVE-2026-44494)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to axios version 1.16.0 or later.

Plugin Details

Severity: High

ID: 318803

File Name: nodejs_module_axios_GHSA-35jp-ww65-95wh.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 6/5/2026

Updated: 6/5/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: High

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-44494

CVSS v3

Risk Factor: High

Base Score: 8.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Vulnerability Information

CPE: cpe:/a:axios:axios

Required KB Items: installed_sw/Node.js, Host/nodejs/modules/enumerated

Patch Publication Date: 5/29/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-44494

IAVA: 2026-A-0534

Detections

Analytics