CVE-2026-44494

What it actually does

Axios versions 1.0.0 through 1.15.x contain a prototype-pollution gadget in the Node.js HTTP adapter. If any other vulnerability or dependency in the application pollutes Object.prototype with a proxy property, Axios reads config.proxy through normal prototype-chain lookup instead of requiring an own property. Because proxy is not defined by default, the polluted inherited value can be treated as Axios configuration and passed to setProxy(), causing outbound HTTP and HTTPS requests made through Axios to be routed through an attacker-controlled proxy. This can expose request URLs, headers, cookies, bearer tokens, API keys, request bodies, and responses, and may allow traffic modification depending on TLS validation and application behavior.

Why it matters to the business

Applications using affected Axios versions can have sensitive outbound service-to-service or user-facing HTTP traffic silently redirected through an attacker-controlled intermediary, potentially exposing credentials, session tokens, personal data, payment data, or business APIs. The flaw is especially significant in Node.js backend services, API gateways, job workers, and server-side rendering applications that use Axios for authenticated calls. Exploitation requires a separate prototype-pollution path, so likelihood is lower than a directly reachable remote code execution issue, but the impact is high because successful exploitation can compromise confidentiality and integrity of many downstream API transactions. It is not currently listed in CISA KEV and no mature public exploitation is indicated, but affected versions are common in JavaScript dependency trees and should be upgraded proactively.

How an attack unfolds

An attacker first identifies an application path or dependency behavior that allows prototype pollution, typically by submitting crafted JSON, query parameters, form fields, or object merge input containing keys such as __proto__, constructor, or prototype. The attacker uses that weakness to add a proxy property to Object.prototype with values pointing to an attacker-controlled proxy host and port. Later, when the application performs outbound requests using an affected Axios version, Axios builds a merged request configuration object that lacks its own proxy property. The Node.js HTTP adapter then reads config.proxy using standard property access, which resolves the attacker-injected inherited Object.prototype.proxy value. Axios calls setProxy() and sends requests through the attacker-controlled proxy. The attacker can then observe destinations, headers, cookies, bearer tokens, API keys, and request/response bodies, and may modify traffic where TLS validation is absent, weakened, intercepted by a trusted proxy certificate, or the request is plain HTTP.

How to fix it

Upgrade Axios to version 1.16.0 or later everywhere it appears, including transitive dependency paths. Use package-manager overrides or resolutions where necessary to force axios >=1.16.0, then regenerate and commit lockfiles. Confirm with commands such as npm ls axios, yarn why axios, pnpm why axios, or equivalent SCA tooling. If immediate upgrade is not possible, reduce risk by explicitly setting an own proxy property on Axios instances and requests, preferably proxy: false where proxies are not required, or a known trusted proxy object where they are required. This mitigation should not replace upgrading. Also remediate any prototype-pollution vulnerabilities in the application and dependencies, reject or sanitize object keys such as __proto__, constructor, and prototype, avoid unsafe deep-merge patterns, and restrict egress so application workloads can only reach approved proxy infrastructure and destinations.

How to confirm the fix worked

Validate remediation by confirming no installed Axios package is below 1.16.0 in source repositories, built artifacts, containers, serverless bundles, and deployed packages. Review lockfiles and SBOM/SCA results for axios versions >=1.0.0 and <1.16.0. In a non-production test environment, verify that polluting Object.prototype.proxy does not influence Axios request routing after upgrade; for example, set Object.prototype.proxy to a local test proxy value, perform an Axios request, then delete the property and confirm Axios does not attempt to use the inherited proxy. Confirm application configurations explicitly define intended proxy behavior and that outbound firewall, proxy, or service-mesh logs show traffic only to approved proxy endpoints.

Typical attack path

1. Find an application endpoint or dependency that accepts attacker-controlled structured input and is vulnerable to prototype pollution.
2. Submit a crafted payload that pollutes Object.prototype with a proxy configuration, such as an attacker-controlled host, port, and protocol.
3. Wait for the application to make outbound HTTP or HTTPS requests using Axios 1.0.0 through 1.15.x in the same Node.js process.
4. Axios reads config.proxy from the prototype chain because the request configuration has no own proxy property.
5. Axios routes outbound requests through the attacker-controlled proxy via setProxy().
6. Attacker captures sensitive request metadata, credentials, headers, payloads, and responses, and may alter traffic depending on transport security controls.

How to detect it

To determine whether exploitation already occurred, combine application-layer, network, and dependency evidence. Review WAF, API gateway, load balancer, and application logs for prototype-pollution payloads using keys such as __proto__, constructor.prototype, or prototype combined with proxy, host, port, protocol, http, or https. Examine Node.js application logs for unexpected Axios proxy behavior, connection failures to unknown proxy hosts, ECONNREFUSED/ETIMEDOUT errors involving proxy endpoints, or sudden changes in outbound request destinations. Review egress firewall, proxy, DNS, VPC flow, EDR, and container network logs for Node.js processes making outbound connections to unapproved proxy servers, especially followed by increased CONNECT traffic or traffic to external hosts not normally contacted directly. Inspect runtime memory or diagnostic dumps, where available, for Object.prototype.proxy or unexpected global prototype properties. If suspicious proxying is confirmed, treat credentials transmitted by affected services during the exposure window as potentially compromised and rotate them.

• __proto__.proxy
• __proto__[proxy]
• constructor.prototype.proxy
• constructor[prototype][proxy]
• prototype.proxy
• Object.prototype.proxy
• "__proto__":{"proxy"
• "constructor":{"prototype":{"proxy"
• "proxy":{"host"
• "proxy":{"protocol"
• proxy.host
• proxy.port
• proxy.protocol
• setProxy(
• lib/adapters/http.js
• CONNECT

What your security team should do

• Prioritize upgrading all direct and transitive Axios installations to 1.16.0 or later, especially in Node.js services that send authenticated API requests.
• Search code and dependencies for known or suspected prototype-pollution issues, unsafe object merge utilities, and input paths accepting nested object keys.
• Add package-manager overrides or dependency constraints to prevent reintroduction of Axios versions >=1.0.0 and <1.16.0.
• Review outbound egress controls and block application workloads from connecting to unapproved proxy servers or arbitrary internet hosts.
• Hunt for evidence of unexpected proxy routing, unusual CONNECT activity, or outbound connections to unknown infrastructure from Node.js services.
• Add SIEM detections for prototype-pollution payload keys in HTTP requests, application logs, API gateway logs, and WAF logs.
• Ensure secrets sent via Axios, such as API tokens and service credentials, can be rotated quickly if suspicious proxying or credential exposure is found.