CVE-2026-44494 Details

A prototype pollution vulnerability has been identified in the Axios library, versions 1.0.0 prior to 1.16.0. This vulnerability allows for Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack. The issue arises because the HTTP adapter reads the config.proxy property through standard property access, which traverses the prototype chain. Since proxy is not included in Axios defaults, the merged config object lacks its own proxy property, making it easily injectable via prototype pollution. Once injected, the setProxy() function routes all HTTP requests through the attacker's proxy server, enabling interception, modification, and reading of all HTTP traffic, including authentication credentials.

To address this vulnerability, Axios should be updated to version 1.16.0 or later, where the issue has been fixed. Additionally, developers can manually check for and remove any prototype pollution before making HTTP requests with Axios.