CVE-2026-44487 Details

A vulnerability exists in Axios versions prior to 0.32.0 and 1.16.0, where the Node.js HTTP adapter may unintentionally forward a Proxy-Authorization header to a redirected origin. This occurs during certain proxy-to-direct redirect flows, affecting Node.js usage. When an HTTP request is sent through an authenticated proxy, and the redirected URL is no longer proxied, the final origin can receive proxy credentials meant only for the outbound proxy. This issue arises because the Axios redirect handling does not properly clear the Proxy-Authorization header before applying new proxy settings for the next request hop.

Users can upgrade to Axios versions 0.32.0 or 1.16.0 or later, where this vulnerability has been fixed. Alternatively, set 'maxRedirects' to 0' and handle redirects manually, ensuring that 'Proxy-Authorization' is not copied to requests that are not sent through the proxy. Avoid using reusable authenticated HTTP proxy credentials for requests to untrusted origins.