Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (axios axios)

CVE-2026-44487

HIGH 8.2

En bref

Source: NVD
EPSS: EPSS 0.69 % · centile 53 (2026-10-29)
État: PUBLISHED
Publiée: 2026-06-11 15:38 UTC
Mise à jour: 2026-09-11 12:08 UTC
Attribuée par: GitHub_M
Statut NVD: Modified

Rechercher sur…

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

Faiblesses (CWE)

CWE-201 — Insertion of Sensitive Information Into Sent Data

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	HIGH 8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat-SADP
CVSS 4.0	HIGH 8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Avis

GHSA-p92q-9vqr-4j8v — Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Références européennes

ENISA EUVD · EUVD-2026-36262
GCVE · GCVE-0-2026-44487

Avis du CERT-FR

CERTFR-2026-AVI-1256 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1094 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0934 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* < 0.32.0
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* ≥ 1.0.0 < 1.16.0

Produits affectés

Produit	Versions
axios · axios	affected >= 1.0.0, < 1.16.0 ; affected < 0.32.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (axios axios)