CVE Almanac
← All CVEs

CVE-2026-44486

HIGH 7.5

Published 2026-06-11 · Last modified 2026-07-01

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.6%chance of exploitation in 30 days · 42nd percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

7.5CVSS 3.1 · HIGH

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Affected

Vendors Axios Red Hat

Products Axios Red Hat Advanced Cluster Management For Kubernetes 2.13 Red Hat Advanced Cluster Security For Kubernetes 4.10 Red Hat Developer Hub 1.9 Red Hat Discovery 2 Red Hat Openshift Container Platform 4.16 Red Hat Openshift Container Platform 4.20 Red Hat Openshift Container Platform 4.21

Weakness (CWE)

  • CWE-200: Information exposure
  • CWE-201

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS