GHSA-654m-c8p4-x5fp
Low · 3.7CVSS
3.7
EPSS
—
Published
May 29, 2026
CISA due date
—
The record
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | axios | 1.15.2 | 1.16.0 |
Related vulnerabilities
- CVE-2026-44489 Axios is a promise based HTTP client for the browser and Node.js. Same vulnerability
- CVE-2026-44496 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44490 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44494 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44495 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44486 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44487 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios