CVE-2026-44494Disclosure(axios / axios)

LOWCVSS 8.7 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch axios axios systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

axios CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-441CWE-1321CWE-915

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

axios

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked at 2 mentions on most recent observed day (2026-06-11)
4 total mentions across 3 days

Affected systems

Vendors

axios

Products

axios

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	1	Disclosure1
2026-06-06	1	Disclosure1
2026-06-11	2	Disclosure1Patch1

Full discourse4 posts

Netlas.io@Netlas_io129d
Disclosure
CVE-2026-44494: Full Man-in-the-Middle via Prototype Pollution Gadget in Axios, 8.7 rating 🔥 The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows an attacker intercept, read, and modify all outgoing HTTP requests including authentication credentials. 👉 https://nt.ls/emv2w
Post summary
A newly disclosed Axios prototype pollution vulnerability (CVE-2026-44494) allows attackers to intercept, read, and modify all outgoing HTTP requests, including authentication credentials, with an 8.7 severity rating.
00031488
7.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds124d
Disclosure
CVE-2026-44494 Prototype Pollution to Man-in-the-Middle Attack in Axios 1.0.0 Be... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44494 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A new CVE (CVE-2026-44494) is disclosed, describing a prototype‑pollution vulnerability in Axios 1.0.0 that could enable man‑in‑the‑middle attacks, but no PoC, exploit code, active exploitation evidence, or patch information is provided.
0000056
4.0K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters124d
Patch
CVE-2026-44494 - Critical Prototype Pollution in Axios. Escalates to full MITM, intercepting HTTP traffic & credentials. CVSS 8.7. No patch available. Update to 1.16.0+ or mitigate immediately. #CVE #Axios #infosec #cybersecurity heave for all experts https://www.valtersit.com/cve/CVE-2026-44494
Post summary
The post alerts readers to a critical prototype‑pollution exploit in Axios that could lead to MITM attacks and urges users to update to version 1.16.0+ or otherwise mitigate, despite no current patch being available.
0000053
928 followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 High - Two axios Security Flaws Disclosed (CVE-2026-44492 & CVE-2026-44494) Two high-severity vulnerabilities in axios (npm) were published today, both enabling network-level attacks by abusing proxy handling logic: axios NO_PROXY Bypass via IPv4-mapped IPv6 (CVE-2026-44492, CVSS 8.6) — shouldBypassProxy (introduced in v1.15.0 to fix CVE-2025-62718) fails to normalize IPv4-mapped IPv6 addresses like ::ffff:169.254.169.254. When NO_PROXY blocks 169.254.169.254, a request to its IPv6-mapped form still routes through the proxy, enabling cloud metadata SSRF against IMDS endpoints. axios Prototype Pollution → Full MITM via config.proxy (CVE-2026-44494, CVSS 9.4) — Because proxy is absent from axios defaults, the merged config object has no own proxy property. Any Object.prototype pollution in the dependency tree (e.g. via qs, minimist) can inject a malicious proxy into all axios HTTP requests, intercepting credentials, auth tokens, and response data with no user interaction and no visible indication. 👉 Affected: axios (npm) ≥ 1.0.0 < 1.16.0 and ≤ 0.31.1 | Upgrade to 1.16.0 / 0.32.0
Post summary
Two high‑severity vulnerabilities in axios were disclosed: CVE‑2026‑44492 (NO_PROXY bypass via IPv4‑mapped IPv6) and CVE‑2026‑44494 (prototype‑pollution MITM). Upgrade to axios 1.16.0 or 0.32.0 mitigates these issues.
0000070
196 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	axios	axios	-	node.js	-

Explore more

Back to dashboard axios CVEs axios vulnerabilities

What researchers are saying

CVE-2026-44494

Netlas.io[verified]@Netlas_ioDisclosure

A newly disclosed Axios prototype pollution vulnerability (CVE-2026-44494) allows attackers to intercept, read, and modify all outgoing HTTP requests, including authentication credentials, with an 8.7 severity rating.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The post alerts readers to a critical prototype‑pollution exploit in Axios that could lead to MITM attacks and urges users to update to version 1.16.0+ or otherwise mitigate, despite no current patch being available.

Upwind Security MDR[verified]@UpwindMDRDisclosure

Two high‑severity vulnerabilities in axios were disclosed: CVE‑2026‑44492 (NO_PROXY bypass via IPv4‑mapped IPv6) and CVE‑2026‑44494 (prototype‑pollution MITM). Upgrade to axios 1.16.0 or 0.32.0 mitigates these issues.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new CVE (CVE-2026-44494) is disclosed, describing a prototype‑pollution vulnerability in Axios 1.0.0 that could enable man‑in‑the‑middle attacks, but no PoC, exploit code, active exploitation evidence, or patch information is provided.