Security Bulletin:Axios Node.js HTTP Adapter Proxy Credential Leakage Vulnerability in 0.32.0 and 1.16.0

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios' Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to ...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

axios: axios: Request socket hijacking via inherited createConnection property

A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious...

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.20.0...

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

GHSA-M8M8-QJ5V-23W3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

GHSA-MGHH-PGCX-3JJJ Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Summary Axios shouldBypassProxy normalizes hostnames with hostname.replace/.+$/, ''. For a hostname shaped as many dots followed by a non-dot, the anchored regex can perform quadratic backtracking. Because axios re-evaluates proxy bypass rules for redirected requests, a malicious server can...

Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

GHSA-542G-H47M-68V8 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Summary Axios versions with Node.js HTTP/2 support can terminate the caller’s process when a ClientHttp2Session emits an error event that is not handled by axios. This affects applications that use the Node HTTP adapter with httpVersion: 2. A malicious, unavailable, or non-HTTP/2 endpoint can cau...

Improper Validation of Specified Quantity in Input

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js,...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

The Axios HTTP client is vulnerable to a request socket hijack in versions 1.15.2 through 1.20.0 . The root cause lies in the Node HTTP adapter (lib/adapters/http.js), which fails to provide its own createConnection value. When combined with a separate same-process prototype-pollution flaw that p...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...

CVE-2026-101905

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...