CVE catalog

CVE-2026-44486

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a r

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed
NpmaxiosNot reported0.32.0fixed
NpmaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourceforky1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeaxioscpeNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNot reportedNot reported
NpmaxiosnpmNot reported0.32.0Not reportedGHSA-J5F8-GRM9-P9FCNot reported
NpmaxiosnpmNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNVD-CVE-2026-44486Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue; needs an authenticated proxy and a redirect to an unproxied target

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

  • [node-axios]Affected
    Details (2)

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]