CVE-2026-44494

Name of the Vulnerable Software and Affected Versions axios versions 0.x through 1.x

Description A prototype pollution gadget in the lib/adapters/http.js component allows an attacker to escalate any Object.prototype pollution within an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This occurs because the HTTP adapter reads the config.proxy property via standard property access, which traverses the prototype chain. Since proxy is not present in the library's defaults, it can be injected via prototype pollution, causing the setProxy() function to route all HTTP traffic through an attacker-controlled proxy server.

This allows a remote attacker to intercept, read, and modify all HTTP traffic, including authentication credentials, cookies, and request bodies. The attacker can also tamper with responses and perform internal network reconnaissance by viewing request URLs. This issue bypasses the mergeConfig logic and is not addressed by the header sanitization patch in version 1.15.0.

Recommendations For versions 0.x through 1.x, use hasOwnProperty when reading security-sensitive configuration properties in lib/adapters/http.js to ensure the property exists on the object itself rather than its prototype. Specifically, the config.proxy property should be accessed as: Object.prototype.hasOwnProperty.call(config, 'proxy') ? config.proxy : undefined.

As a temporary mitigation, restrict access to the config.proxy property or ensure that no dependencies in the application stack are vulnerable to prototype pollution.