Server-side request forgery in axios
Priority HIGH 76CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 48 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.1228 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.16.0, 0.32.0axios (npm): 1.16.0, 0.32.0Red Hat: 51 advisoriesRed Hat: 48 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| axios | axios | 1.0.0 to before 1.16.0; before 0.32.0 | 1.16.0, 0.32.0 | Patch available | CNA |
| — | axios (npm) | 1.15.0 to before 1.16.0 | 1.16.0 | Patch available | GHSA-pjwm-pj3p-43mv |
| — | axios (npm) | before 0.32.0 | 0.32.0 | Patch available | GHSA-pjwm-pj3p-43mv |
- axios Vendoraxios Affected 1.0.0 to before 1.16.0; before 0.32.0 Fixed in 1.16.0, 0.32.0 Patch available CNA
- axios (npm) Vendor— Affected 1.15.0 to before 1.16.0 Fixed in 1.16.0 Patch available GHSA-pjwm-pj3p-43mv
- axios (npm) Vendor— Affected before 0.32.0 Fixed in 0.32.0 Patch available GHSA-pjwm-pj3p-43mv
Remediation
- Fix · CNA axios (axios) Fixed in 1.16.0, 0.32.0
- Fix · GHSA-pjwm-pj3p-43mv axios (npm) Fixed in 1.16.0 Advisory →
- Fix · GHSA-pjwm-pj3p-43mv axios (npm) Fixed in 0.32.0 Advisory →
Red Hat 51 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:73377 Released 2026-09-29 · Red Hat rating ImportantOpenShift Virtualization v4.12 Images
- Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
Show 48 more Red Hat advisories
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:59833 Released 2026-09-03 · Red Hat rating ImportantOpenShift Container Platform 4.12.97 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:54188 Released 2026-08-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.70 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
- RHSA-2026:57191 Released 2026-08-19 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
- RHSA-2026:50300 Released 2026-08-04 · Red Hat rating ImportantMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
- RHSA-2026:47451 Released 2026-07-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
- RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:46903 Released 2026-07-27 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
- RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:43052 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42796 Released 2026-07-21 · Red Hat rating ImportantRed Hat Quay 3.15.6
- Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42146 Released 2026-07-20 · Red Hat rating ImportantRed Hat Quay 3.12.20
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:42142 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/gateway-rhel9, registry.redhat.io/ansible-automation-platform-27/hub-rhel9, registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9 +3
- RHSA-2026:42078 Released 2026-07-20 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
- RHSA-2026:42085 Released 2026-07-20 · Red Hat rating ImportantRHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rhtas-console-ui-rhel9
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:41928 Released 2026-07-20 · Red Hat rating ImportantRed Hat Migration Toolkit for Containers
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
- RHSA-2026:41066 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.16.5
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:41064 Released 2026-07-16 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
- RHSA-2026:41055 Released 2026-07-16 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.12 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
- RHSA-2026:41031 Released 2026-07-16 · Red Hat rating ImportantRed Hat Quay 3.10.24
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:36611 Released 2026-07-16 · Red Hat rating ImportantOpenShift Container Platform 4.14.69 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8, registry.redhat.io/openshift4/ose-prometheus +1
- RHSA-2026:40262 Released 2026-07-15 · Red Hat rating ImportantRed Hat Quay 3.9.24
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:36883 Released 2026-07-08 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.5 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
- RHSA-2026:36882 Released 2026-07-08 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.14.3 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-cli-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9 +10
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:36754 Released 2026-07-08 · Red Hat rating ImportantRed Hat Developer Hub 1.10.2 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:34766 Released 2026-07-08 · Red Hat rating ImportantOpenShift Container Platform 4.19.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:36108 Released 2026-07-07 · Red Hat rating ImportantOpenShift Virtualization v4.13 Images
- Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2026:28964 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.15.66 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
- RHSA-2026:29082 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.16.65 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel9, registry.redhat.io/openshift4/ose-cluster-capi-rhel9-operator +8
- RHSA-2026:33574 Released 2026-06-30 · Red Hat rating ImportantRed Hat Developer Hub 1.9.6 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:33183 Released 2026-06-29 · Red Hat rating ImportantKiali 2.22.6 for Red Hat OpenShift Service Mesh 3.3
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33173 Released 2026-06-29 · Red Hat rating ImportantKiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2
- Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33163 Released 2026-06-29 · Red Hat rating ImportantKiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1
- Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33160 Released 2026-06-29 · Red Hat rating ImportantKiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0
- Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
- RHSA-2026:33155 Released 2026-06-29 · Red Hat rating ImportantKiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6
- Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8
- RHSA-2026:33005 Released 2026-06-29 · Red Hat rating ImportantOpenShift Virtualization v4.14 Images
- Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
- RHSA-2026:30651 Released 2026-06-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
- RHSA-2026:30650 Released 2026-06-28 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.8 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
- RHSA-2026:29197 Released 2026-06-24 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:27063 Released 2026-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.20.26 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +3
- RHSA-2026:27044 Released 2026-06-23 · Red Hat rating ImportantOpenShift Container Platform 4.21.21 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-haproxy-router-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:22465 Released 2026-06-02 · Red Hat rating ImportantRed Hat Quay 3.17.2
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:20938 Released 2026-05-26 · Red Hat rating ImportantRHACS 4.9.7 security and bug fix update
- Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
- RHSA-2026:20889 Released 2026-05-26 · Red Hat rating ImportantRHACS 4.10.3 security and bug fix update
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 | Fixed | RHSA-2026:41064 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:30651 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2026:36882 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2026:46903 |
| Red Hat Advanced Cluster Management for Kubernetes 2.16 | Fixed | RHSA-2026:57191 |
| Red Hat Advanced Cluster Security 4.9 | Fixed | RHSA-2026:20938 |
| Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 | Fixed | RHSA-2026:20889 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:42142 |
| Red Hat Container Native Virtualization 4.12 | Fixed | RHSA-2026:73377 |
| Red Hat Container Native Virtualization 4.13 | Fixed | RHSA-2026:36108 |
| Red Hat Container Native Virtualization 4.14 | Fixed | RHSA-2026:33005 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Developer Hub 1.10 | Fixed | RHSA-2026:36754 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:33574 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:29197 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:41928 |
| Red Hat Migration Toolkit for Applications 8.1 | Fixed | RHSA-2026:50300 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:59833 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:54188 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:36611 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:28964 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:29082 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:34766 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:27063 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:27044 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
| Red Hat OpenShift Service Mesh 2.6 | Fixed | RHSA-2026:33155 |
| Red Hat OpenShift Service Mesh 3.0 | Fixed | RHSA-2026:33160 |
| Red Hat OpenShift Service Mesh 3.1 | Fixed | RHSA-2026:33163 |
| Red Hat OpenShift Service Mesh 3.2 | Fixed | RHSA-2026:33173 |
| Red Hat OpenShift Service Mesh 3.3 | Fixed | RHSA-2026:33183 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:41031 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:42146, RHSA-2026:43052 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.15 | Fixed | RHSA-2026:42796 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:41066 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:22465 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:40262 |
| Red Hat Trusted Artifact Signer 1.3 | Fixed | RHSA-2026:42085 |
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:46885 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:41055 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:30650 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:36883 |
Not affected: 53 products
- Cryostat 4
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Network Observability Operator
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2.11
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Advanced Cluster Management for Kubernetes 2.16
- Red Hat Advanced Cluster Security 4.9
- Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.7
- Red Hat Developer Hub 1.10
- Red Hat Developer Hub 1.9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Migration Toolkit 1.8
- Red Hat Migration Toolkit for Applications 8.1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Service Mesh 3.3
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.14
- Red Hat Quay 3.15
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.9
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer 1.3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Apicurio Registry 3
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44492
- 2026-10-03 Alias added: GHSA-pjwm-pj3p-43mv
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-25 EPSS moved to the 95th–99th percentile
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
References
Advisory 2
Other 35
- https://access.redhat.com/errata/RHSA-2026:36611
- https://access.redhat.com/errata/RHSA-2026:36754
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:36883
- https://access.redhat.com/errata/RHSA-2026:40119
- https://access.redhat.com/errata/RHSA-2026:40138
- https://access.redhat.com/errata/RHSA-2026:40262
- https://access.redhat.com/errata/RHSA-2026:41031
- https://access.redhat.com/errata/RHSA-2026:41055
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:41066
- https://access.redhat.com/security/cve/CVE-2026-44492
- https://bugzilla.redhat.com/show_bug.cgi?id=2487938
- https://github.com/axios/axios
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:27044
- https://access.redhat.com/errata/RHSA-2026:27063
- https://access.redhat.com/errata/RHSA-2026:28964
- https://access.redhat.com/errata/RHSA-2026:29082
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:30650
- https://access.redhat.com/errata/RHSA-2026:30651
- https://access.redhat.com/errata/RHSA-2026:33005
- https://access.redhat.com/errata/RHSA-2026:33155
- https://access.redhat.com/errata/RHSA-2026:33160
- https://access.redhat.com/errata/RHSA-2026:33163
- https://access.redhat.com/errata/RHSA-2026:33173
- https://access.redhat.com/errata/RHSA-2026:33183
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:34766
- https://access.redhat.com/errata/RHSA-2026:36108
More Axios vulnerabilities
- TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
- TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
- TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
- TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
- TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
- TI-2026-32424 Axios: Allocation of Resources Without Limits or Throttling in axios CVSS 3.1HIGH 7.5
Sources
- CVE-2026-44492 · CVE Program
- CVE-2026-44492 · NVD
- FIRST EPSS
- GHSA-pjwm-pj3p-43mv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44492 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences