CVE-2026-44495

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-44495) has been identified in Axios’s configuration processing and response transformation. If another vulnerability has already polluted Object.prototype.transformResponse, Axios may consume that inherited value as configuration or an option validator. This can cause request failures or denial of service. When the polluted value is a function, affected versions may execute it, potentially exposing credentials or altering response data.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. Modified prototype properties can influence objects that inherit them, changing application behavior. Axios consumes previously polluted properties, so exploitation requires a separate flaw or equivalent attacker control over the shared prototype. Credential exposure and response tampering additionally depend on the ability to supply a function-valued property.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.15.2; >=0.19.0, <0.31.1
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.15.2
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This high-severity vulnerability affects browser and Node.js applications using vulnerable Axios versions in an already polluted JavaScript environment. Inherited transformResponse values can influence configuration merging or validation. The GitHub advisory assigns a CVSS v3.1 score of 7.0.

Pollution limited to JSON-like values primarily causes request failures or denial of service. Function-valued pollution can expose request configuration; in fully affected versions, it can also inspect and replace response data. Some later affected versions permit execution during validation without replacing the response transform.

This behavior aligns with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The security impact arises when inherited properties cross into trusted application behavior. Its extent depends on the attacker’s control over those properties and the affected processing path, with potential consequences for confidentiality, integrity, and availability.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.