CVE-2026-44486

What it actually does

In affected Node.js use of Axios, proxy authentication material can be unintentionally forwarded to a redirect destination. When Axios sends a request through an authenticated proxy, it may attach a Proxy-Authorization header. If the original request receives a redirect and the follow-up request is no longer routed through that proxy, affected versions can retain the stale Proxy-Authorization header and send it to the redirected server. This exposes proxy credentials to an unintended remote endpoint. The browser adapter is not affected; the issue is specific to Axios usage in Node.js with automatic redirects enabled and an authenticated proxy configuration.

Why it matters to the business

Applications that use Axios in Node.js behind authenticated proxies may leak proxy credentials to external or attacker-controlled redirect targets. If those credentials are reused or grant broad network egress capability, an attacker could abuse them to route traffic through corporate proxy infrastructure, bypass network controls, access restricted destinations, or support further reconnaissance. The risk is highest for services that call untrusted or partner-controlled URLs, follow redirects automatically, or use shared proxy credentials across multiple applications.

How an attack unfolds

An attacker needs to influence a URL that a vulnerable Node.js application requests with Axios, or control a service that the application already contacts. The application sends the request through an authenticated proxy, causing Axios to add a Proxy-Authorization header. The attacker-controlled endpoint responds with an HTTP redirect to a destination that is not supposed to use that proxy. In vulnerable versions, Axios follows the redirect automatically and may preserve the Proxy-Authorization header on the redirected request. The redirected server then receives the proxy credential in the request headers. The attacker can capture the header from web server, application, CDN, reverse-proxy, or packet logs and attempt to decode or replay the credential against the proxy, depending on proxy configuration and credential type.

How to fix it

Upgrade Axios to a fixed version: 0.32.0 or later for the 0.x line, or 1.16.0 or later for the 1.x line. Ensure package-lock.json, yarn.lock, pnpm-lock.yaml, and container images are rebuilt so the fixed dependency is actually deployed. If immediate upgrade is not possible, disable automatic redirects for sensitive requests, avoid allowing Axios to request untrusted redirect-capable URLs through authenticated proxies, strip Proxy-Authorization from redirected requests, use per-service low-privilege proxy credentials, and rotate any proxy credentials that may have been exposed. Review wrapper libraries and downstream packages that bundle or pin Axios, because transitive dependency use may preserve vulnerable versions even when top-level application code does not directly import Axios.

How to confirm the fix worked

Confirm that deployed applications use Axios 0.32.0 or later, or 1.16.0 or later, by inspecting dependency manifests, lockfiles, SBOMs, build artifacts, and runtime package trees. In Node.js projects, run dependency inventory commands such as npm ls axios, yarn why axios, or pnpm why axios and verify no affected versions are present. Test representative proxy-enabled Axios calls against a controlled redirect endpoint and confirm that Proxy-Authorization is not present on the redirected request when the redirect target should not receive proxy credentials. Also verify that CI/CD dependency scanning, container scanning, and software composition analysis flag Axios versions prior to the fixed releases.

Typical attack path

1. Identify a Node.js application or service that uses Axios with an authenticated proxy configuration.
2. Find a request path where the application fetches an attacker-controlled, user-influenced, or redirect-capable URL.
3. Cause the first Axios request to be sent through the authenticated proxy.
4. Return an HTTP 3xx redirect to a destination where the proxy should no longer be used.
5. Allow Axios to automatically follow the redirect using an affected version.
6. Capture the leaked Proxy-Authorization header at the redirect target.
7. Attempt to reuse the exposed proxy credential or use it for further network access, traffic relay, or reconnaissance.

How to detect it

Look for evidence that proxy credentials were forwarded to redirect targets or captured by systems that should never receive them. Relevant sources include outbound proxy logs, application HTTP client debug logs, reverse-proxy logs, CDN or WAF request logs, destination web server access logs, packet captures, and application telemetry that records request headers. Search for Proxy-Authorization headers appearing in requests to application servers, external endpoints, redirect handlers, webhook receivers, partner integrations, or logging platforms. Correlate those events with Axios-based Node.js services, HTTP 301/302/303/307/308 responses, and follow-up requests to a different host or scheme. If header values are found outside proxy infrastructure, treat the corresponding proxy credentials as exposed and rotate them. Also review logs for unusual outbound proxy authentication attempts, new source IPs using known proxy accounts, elevated egress volume, or requests to destinations not normally accessed by the affected service.

• Proxy-Authorization: Basic
• Proxy-Authorization: Bearer
• Proxy-Authorization: Negotiate
• Proxy-Authorization: NTLM
• proxy-authorization
• HTTP 301
• HTTP 302
• HTTP 303
• HTTP 307
• HTTP 308
• axios/
• follow-redirects
• npm ls axios
• "axios": "0.
• "axios": "1.15
• "axios": "1.14
• "axios": "1.13
• "axios": "1.12
• "axios": "1.11
• "axios": "1.10
• "axios": "1.9
• "axios": "1.8
• "axios": "1.7
• "axios": "1.6
• "axios": "1.5
• "axios": "1.4
• "axios": "1.3
• "axios": "1.2
• "axios": "1.1
• "axios": "1.0

What your security team should do

• Prioritize remediation for Node.js services that use Axios with authenticated HTTP or HTTPS proxy settings and automatic redirects enabled.
• Upgrade Axios to 0.32.0 or 1.16.0 or later across direct and transitive dependency paths.
• Inventory applications that make outbound requests to user-supplied, partner-controlled, webhook, integration, or otherwise untrusted URLs.
• Rotate proxy credentials used by vulnerable applications if logs or testing indicate they may have been sent to unintended redirect targets.
• Enforce least-privilege proxy accounts, scoped egress policies, and per-application proxy credentials to reduce blast radius.
• Add regression tests that verify Proxy-Authorization is never forwarded to non-proxy redirect destinations.
• Review outbound proxy, web server, CDN, and application logs for evidence that Proxy-Authorization headers were received by systems that should not see them.