Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2026-44486

High
7.5/10

Summary

Axios versions prior to 0.32.0 in the 0.x release line and prior to 1.16.0 in the 1.x release line are affected by a vulnerability in the Node.js HTTP adapter that may expose proxy credentials during redirects. When a request is sent through an authenticated proxy, Axios adds a Proxy-Authorization header containing the proxy credentials. If the request follows a redirect and the subsequent request is no longer routed through the proxy, Axios may incorrectly retain the Proxy-Authorization header. As a result, the proxy credentials could be unintentionally transmitted to the redirect destination, potentially leading to credential disclosure.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published