CVE-2026-44487

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0

Description The Node.js HTTP adapter in Axios may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This occurs when an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. In these cases, the final origin can receive proxy credentials intended only for the outbound proxy. This issue is limited to the Node.js HTTP adapter; browser, XHR, fetch, and React Native adapter paths are not affected. The root cause is located in the setProxy() function within lib/adapters/http.js, which failed to clear the Proxy-Authorization header when a redirected request no longer resolved to a proxy.

Recommendations Update to version 0.32.0 or later. Update to version 1.16.0 or later. As a temporary workaround, set maxRedirects: 0 and handle redirects manually to ensure Proxy-Authorization is not copied to requests not sent through the proxy.