CVE-2026-44486

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0

Description The Node.js HTTP adapter in Axios can leak proxy credentials to a redirect target. When a request is sent through an authenticated proxy, the Proxy-Authorization header is added. If the request follows a redirect and the subsequent request is no longer sent through that proxy, the stale Proxy-Authorization header may remain and be sent to the redirect target. This occurs when automatic redirects are enabled and an authenticated proxy is configured, specifically within the setProxy() function in the lib/adapters/http.js file. This issue does not affect browser adapters, XHR, or fetch adapter behavior, nor does it affect requests where maxRedirects is set to 0.

Recommendations Update to version 0.32.0 or later. Update to version 1.16.0 or later. Set maxRedirects to 0 and handle redirects manually. Avoid using authenticated proxy environment variables for requests to untrusted HTTP origins unless redirect behavior is controlled. Ensure proxy environment variables are configured consistently across protocols to prevent redirects from unexpectedly changing from proxied to direct connections.