CVE-2026-44489

Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.

• CWE-113
• CWE-1321

• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fpExploit, Vendor Advisory
• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fpExploit, Vendor Advisory

Published

Jun 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44482soundcloud-rpc is a SoundCloud Client with Discord Rich Pres…9.6
• CVE-2026-44483RVF (formerly Remix Validated Form) provides easy form valid…8.2
• CVE-2026-44484PyTorch Lightning is a deep learning framework to pretrain a…9.8
• CVE-2026-44486Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44487Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44488Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-4449Use after free in Blink in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-44490Axios is a promise based HTTP client for the browser and Nod…8.2
• CVE-2026-44492Axios is a promise based HTTP client for the browser and Nod…8.6
• CVE-2026-44494Axios is a promise based HTTP client for the browser and Nod…8.7
• CVE-2026-44495Axios is a promise based HTTP client for the browser and Nod…7
• CVE-2026-44496Axios is a promise based HTTP client for the browser and Nod…7.5