CVE catalog

CVE-2026-44495

Severity: High · CVSS 7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Published: May 26, 2026, 11:34:12 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.85% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-axios	sid	`1.20.0-1`	fixed
Debian	node-axios	forky	`1.20.0-1`	fixed
Debian	node-axios	trixie	`1.8.4+dfsg-1`	vulnerable
Debian	node-axios	bookworm	`1.2.1+dfsg-1+deb12u1`	vulnerable
Cpe	node-axios	Not reported	Not reported	vulnerable
Npm	axios	Not reported	`0.31.1`	fixed
Npm	axios	Not reported	`0.31.1`	fixed
Cpe	axios	Not reported	`1.15.2`	fixed
Cpe	advanced_cluster_management_for_kubernetes	Not reported	`2.13.9`	fixed
Cpe	advanced_cluster_security	Not reported	`4.10.3`	fixed
Cpe	ansible_automation_platform	Not reported	Not reported	unknown
Cpe	data_grid	Not reported	Not reported	unknown
Cpe	developer_hub	Not reported	Not reported	unknown
Cpe	discovery	Not reported	Not reported	unknown
Cpe	openshift_container_platform	Not reported	Not reported	unknown
Cpe	openshift_dev_spaces	Not reported	Not reported	unknown
Cpe	openshift_service_mesh	Not reported	Not reported	unknown
Cpe	openshift_virtualization	Not reported	Not reported	unknown
Cpe	quay	Not reported	Not reported	unknown

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-axios	source	sid	`1.15.2-1`	not yet assigned	Not reported	Not reported
Debian	node-axios	source	forky	`1.15.2-1`	not yet assigned	Not reported	Not reported
Debian	node-axios	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	node-axios	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Npm	axios	npm	Not reported	`0.31.1`	Not reported	GHSA-3G43-6GMG-66JW	Not reported
Npm	axios	npm	Not reported	`0.31.1`	Not reported	Not reported	Not reported
Cpe	axios	cpe	Not reported	`1.15.2`	Not reported	NVD-CVE-2026-44495	Not reported
Cpe	advanced_cluster_management_for_kubernetes	cpe	Not reported	`2.13.9`	Not reported	NVD-CVE-2026-44495	Not reported
Cpe	advanced_cluster_security	cpe	Not reported	`4.10.3`	Not reported	NVD-CVE-2026-44495	Not reported

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue; prototype-pollution gadget, needs a separate pollution primitive in the same process

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-axios]Affected
Details (2)
- 1.2.1+dfsg-1+deb12u1 · all · bookworm
  Affected
  nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12
- 1.2.1+dfsg-1+deb12u1 · all · bookworm
  Affected
  nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

[node-axios]Affected
Details (2)
- 1.8.4+dfsg-1 · all · trixie
  Affected
  nvd · node-axios · debian · 13
- 1.8.4+dfsg-1 · all · trixie
  Affected
  nvd · node-axios · debian · 13

Observed: Oct 23, 2026, 10:02:44 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]