Read the docs
TI-2026-32426 Aliases CVE-2026-44490GHSA-898c-q2cr-xwhg

Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Priority HIGH 69CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Partial Red Hat: 35 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00332 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.16.0, 0.32.0axios (npm): 1.16.0, 0.32.0Red Hat: 35 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.0.0 to before 1.16.0; before 0.32.01.16.0, 0.32.0Patch availableCNA
—axios (npm)1.0.0 to before 1.16.01.16.0Patch availableGHSA-898c-q2cr-xwhg
—axios (npm)before 0.32.00.32.0Patch availableGHSA-898c-q2cr-xwhg
  • axios Vendoraxios Affected 1.0.0 to before 1.16.0; before 0.32.0 Fixed in 1.16.0, 0.32.0 Patch available CNA
  • axios (npm) Vendor— Affected 1.0.0 to before 1.16.0 Fixed in 1.16.0 Patch available GHSA-898c-q2cr-xwhg
  • axios (npm) Vendor— Affected before 0.32.0 Fixed in 0.32.0 Patch available GHSA-898c-q2cr-xwhg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*before 0.32.0; 1.0.0 to before 1.16.0Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions before 0.32.0; 1.0.0 to before 1.16.0 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.16.0, 0.32.0
  • Fix · GHSA-898c-q2cr-xwhg axios (npm) Fixed in 1.16.0 Advisory →
  • Fix · GHSA-898c-q2cr-xwhg axios (npm) Fixed in 0.32.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
Gatekeeper 3AffectedNo fix yet: Fix deferred
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Multicluster Engine for KubernetesAffectedNo fix yet: Fix deferred
Network Observability OperatorAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 2AffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat 3scale API Management Platform 2AffectedNo fix yet: Fix deferred
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Build of Podman Desktop - Tech PreviewAffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Discovery 2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
Red Hat Trusted Profile AnalyzerAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44490
  2. 2026-10-03 Alias added: GHSA-898c-q2cr-xwhg
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-10-30 Affected versions changed · Red Hat

References

Exploit 1

Advisory 2

Other 1

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
  • TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences