CVE-2026-44487

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-44487) has been identified in Axios’s Node.js HTTP adapter during certain HTTP-to-HTTPS redirects. When an initial request uses an authenticated proxy but the redirected request connects directly, Axios may retain the Proxy-Authorization header. If the redirect layer does not remove it, credentials intended only for the proxy are forwarded to the destination server, potentially exposing them to an attacker.

This unintended credential disclosure maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), where transmitted data includes information the recipient should not receive. In Axios, retaining a proxy authentication header across a redirect can disclose proxy credentials to an origin server. This crosses the intended trust boundary between authentication to the proxy and communication with the destination.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.16.0; <0.32.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.16.0
  • OSS Axios v0.32.0
  • NES for Axios

Vulnerability Info

This high-severity vulnerability affects Node.js applications using Axios’s HTTP adapter with authenticated proxy access and redirect following enabled. The GitHub advisory assigns a CVSS v4.0 score of 8.2.

The leak occurs when a redirected request no longer uses a proxy and confidential-header handling leaves Proxy-Authorization intact, such as in certain same-host HTTP-to-HTTPS redirects. An attacker-controlled destination can then receive the retained credentials. Reusing them requires a reachable proxy and sufficient permissions under its access controls. Browser adapters are unaffected.

This behavior aligns with CWE-201 (Insertion of Sensitive Information Into Sent Data). Credentials must remain restricted to their intended recipient, including when routing changes. Forwarding authentication data beyond that boundary can compromise confidentiality even when the connection to the unintended recipient is encrypted.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.