Executive Summary

CVE-2026-44489 is a security vulnerability in the Axios library versions 1.15.2 and potentially 1.15.1 that allows an attacker to inject a Proxy-Authorization header via prototype pollution.

The issue arises because nested objects created by utils.merge() (such as config.proxy) are plain objects inheriting from Object.prototype. The setProxy() function reads proxy.username, proxy.password, and proxy.auth without checking if these properties belong directly to the proxy object (i.e., without hasOwnProperty checks).

If an attacker can pollute Object.prototype by adding username or password properties, setProxy() will use these attacker-controlled values to construct a Proxy-Authorization header and inject it into every proxied HTTP request.

This vulnerability requires two conditions: the presence of prototype pollution in the dependency tree and explicit proxy configuration in the application.

It was fixed in Axios version 1.16.0 by adding hasOwnProperty checks and ensuring that nested objects do not inherit from Object.prototype.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to spoof the proxy identity by injecting attacker-controlled credentials into the Proxy-Authorization header of proxied HTTP requests.

The impact is limited: attackers can manipulate proxy logs or cause the application to authenticate to a proxy with attacker-supplied credentials, but they cannot access or modify the actual request or response data.

Exploitation requires that the application explicitly configures a proxy and that there is prototype pollution in the dependency tree.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if your application uses Axios versions between 1.15.2 and before 1.16.0, especially if it explicitly configures a proxy (config.proxy) and if there is a possibility of prototype pollution in the dependency tree.

Since the vulnerability involves injection of Proxy-Authorization headers with attacker-controlled credentials, you can monitor outgoing HTTP requests for unexpected or suspicious Proxy-Authorization headers.

There are no specific commands provided in the resources, but general approaches include:

• Check the Axios version used in your project by running: `npm list axios` or `yarn list axios`.
• Inspect your application code or configuration for explicit proxy settings (e.g., config.proxy).
• Use network monitoring tools (like Wireshark or tcpdump) to capture HTTP traffic and filter for Proxy-Authorization headers to detect unexpected values.
• Audit your dependency tree for prototype pollution vulnerabilities that could affect nested objects.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade Axios to version 1.16.0 or later where the issue is fixed.

If upgrading is not immediately possible, consider the following mitigations:

• Ensure that the setProxy() function performs hasOwnProperty checks before reading proxy.username, proxy.password, and proxy.auth.
• Modify or patch utils.merge() to create objects with null prototypes to prevent prototype pollution.
• Avoid configuring explicit proxy settings in Axios if not necessary.
• Audit and fix any prototype pollution vulnerabilities in your dependency tree.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to inject a Proxy-Authorization header with attacker-controlled credentials into proxied HTTP requests, potentially spoofing proxy identity or manipulating proxy logs.

However, the impact is limited as attackers cannot access the actual request or response data.

Because the vulnerability does not lead to unauthorized access to sensitive data, its direct effect on compliance with data protection regulations such as GDPR or HIPAA is limited.

Nonetheless, the ability to manipulate proxy logs or spoof proxy identity could indirectly affect audit integrity or traceability, which are important aspects of compliance frameworks.

Useful 0 Not Useful 0