Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2,…
Historical advisory recorded 25 Oct 2026 10:17:27 UTC. Read the latest advisory.
nvd · CVE-2026-44495
PublishedAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2026-44495
PublishedAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has …
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Modified
Weakness classifications: CWE-94 · CWE-1321 · CWE-915
Original publisher date fields
published: 2026-06-11T17:16:33.450
lastModified: 2026-09-11T13:18:08.610
12 source CPE criteria · context only
- cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernates:*:*
- cpe:2.3:a:redhat:ansible_automation_platform:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:data_grid:8.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:developer_hub:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_service_mesh:-:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_virtualization:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:quay:-:*:*:*:*:*:*:*
The original JSON retains the logical configuration operators, exclusions and version bounds.
- Source published
- 11 Jun 2026 17:16:33 UTC
- Source modified
- 11 Sep 2026 13:18:08 UTC
- Saved here
- 25 Oct 2026 10:17:27 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS 3.1 · [email protected] · Primary · 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary · 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L