CVE-2026-44490

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-44490) has been identified in Axios’s configuration and header merging logic. If a separate vulnerability pollutes Object.prototype, Axios can inherit attacker-controlled values during request preparation. These values can inject unintended HTTP headers or cause configuration merging to throw a TypeError, preventing requests from being sent and potentially causing denial of service.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. Modified prototype properties can influence objects that inherit them, altering application behavior. Axios acts as a consumer of previously polluted properties: exploitation requires another component to modify the shared prototype first. The resulting effects include header injection and request failures.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.16.0; <0.32.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • NES for Axios 0.24.2
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1

Vulnerability Info

This medium-severity vulnerability affects Axios applications where an attacker can pollute Object.prototype through another component in the same process. The Axios advisory assigns a CVSS v3.1 score of 4.8.

Axios’s merge logic can copy inherited header values into outgoing requests. Separately, polluted get or set properties can interfere with property-descriptor creation, causing request preparation to fail with a TypeError. These behaviors can alter request integrity or disrupt application functionality. Exploitation depends on an existing prototype pollution flaw.

This behavior aligns with CWE-1321 (Prototype Pollution). Shared prototype modifications can affect otherwise unrelated objects, allowing malicious values to influence downstream processing. The practical consequences depend on which properties are modified and how the application handles the resulting behavior.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.