CVE-2026-44495 Details

A prototype pollution vulnerability has been identified in Axios, a promise-based HTTP client for the browser and Node.js. This issue affects Axios versions 0.19.0 prior to 0.31.1 and 1.15.2, allowing inherited values from a polluted Object.prototype to be misinterpreted as request configuration or option validators. The vulnerability requires a separate prototype-pollution issue or equivalent control over Object.prototype before Axios processes a request. While Axios does not introduce the prototype pollution, the flaw can be exploited if another vulnerability has already compromised Object.prototype.transformResponse.

Users should upgrade to Axios versions 0.31.1 or 1.15.2, where this vulnerability has been fixed.