CVE catalog

CVE-2026-44487

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specif

[CVE catalog]

Severity
High · CVSS 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.69% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed
NpmaxiosNot reported0.32.0fixed
NpmaxiosNot reported0.32.0fixed
CpeaxiosNot reported1.16.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourceforky1.16.0-1not yet assignedNot reportedNot reported
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpeaxioscpeNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNot reportedNot reported
NpmaxiosnpmNot reported0.32.0Not reportedGHSA-P92Q-9VQR-4J8VNot reported
NpmaxiosnpmNot reported0.32.0Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.16.0Not reportedNVD-CVE-2026-44487Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue; needs an authenticated proxy and a redirect to an unproxied target

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

  • [node-axios]Affected
    Details (2)

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]