Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-44489 · CVE overview and exploitation status

EUVD-2026-36256

GHSA-654m-c8p4-x5fp

cve-program · CVE-2026-44489

• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp

euvd · EUVD-2026-36256

• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp

nvd · CVE-2026-44489

• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp

osv · GHSA-654m-c8p4-x5fp

• https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
• https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
• https://nvd.nist.gov/vuln/detail/CVE-2026-44489
• https://github.com/axios/axios

• Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProx… · Advisory content revised · 15 Nov 2026