Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

🗓️ 04 Jun 2026 14:15:01Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 378 Views

Axios Node.js HTTP adapter may leak Proxy-Authorization on redirect when proxy is re-evaluated.

Reporter	Title	Published	Views	Family All 292
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.	9 Sep 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios	14 Jul 202619:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026	1 Sep 202618:42	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in axios bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.	2 Oct 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities	9 Jul 202618:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)	21 Sep 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44489, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44496)	24 Jul 202616:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Appliance is affected by multiple JavaScript Node.js vulnerabilities	10 Sep 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin:Axios Node.js HTTP Adapter Proxy Credential Leakage Vulnerability in 0.32.0 and 1.16.0	7 Oct 202617:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	17 Aug 202610:39	–	ibm

Vulners

Node

axios axiosRange≤0.31.1npm

axios axiosRange1.0.0–1.16.0npm

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc
github	www.github.com/axios/axios/pull/10794
github	www.github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b
github	www.github.com/axios/axios/releases/tag/v0.32.0
github	www.github.com/axios/axios/releases/tag/v1.16.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44486
github	www.github.com/advisories/GHSA-j5f8-grm9-p9fc

12 Jun 2026 19:24Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

EPSS0.0076

SSVC

CWE-200