-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16283 more potentially affected by CVE-2026-44490 via axios (>=1.0.0, <=1.15.2)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-44490 Source advisory: SNYK:JS-AXIOS-17111081...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16283 more potentially affected by CVE-2026-44490 via axios (>=1.0.0, <=1.15.2)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-44490 Source advisory: OSV:GHSA-898C-Q2CR-XWHG...

GHSA-898C-Q2CR-XWHG axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Summary axios 1.15.2 exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process e.g. lodash .merge / CVE-2018-16487, axios silently picks up the polluted values: 1. Header injection - lib/utils.js line 406 builds merge's...

GHSA-654M-C8P4-X5FP Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Patch Bypass Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix in Axios 1.15.2 Summary The Object.createnull fix introduced in Axios 1.15.2 GHSA-q8qp-cvcw-x6jj protects the top-level config object from prototype pollution. However, nested objects created...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the setProxy function. An attacker can inject arbitrary credentials into the Proxy-Authorization header of proxied HTTP requests b...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the setProxy function. An attacker can inject arbitrary credentials into the Proxy-Authorization header of proxied HTTP requests by polluting the...

123pancli (1.0.0), @abhinav-dev/mcp-platform-kit (1.0.0) +1068 more potentially affected by CVE-2026-42264 +1 more via axios (1.15.2)

axios NPM version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on axios and may be impacted: - 123pancli 1.0.0 - @abhinav-dev/mcp-platform-kit 1.0.0 - @activepieces/piece-ai 0.4.4 - @activepieces/piece-amazon-bedrock 0.1.2 -...

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Patch Bypass Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix in Axios 1.15.2 Summary The Object.createnull fix introduced in Axios 1.15.2 GHSA-q8qp-cvcw-x6jj protects the top-level config object from prototype pollution. However, nested objects created...

123pancli (1.0.0), @abhinav-dev/mcp-platform-kit (1.0.0) +1068 more potentially affected by CVE-2026-44489 via axios (1.15.2)

axios NPM version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on axios and may be impacted: - 123pancli 1.0.0 - @abhinav-dev/mcp-platform-kit 1.0.0 - @activepieces/piece-ai 0.4.4 - @activepieces/piece-amazon-bedrock 0.1.2 -...

Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-40175)

Summary IBM Security SOAR uses an older version of the Axios component that may be identified and exploited. Updates for supported versions have been released which address the issue. It is recommended to upgrade to version 51.0.10.0 Vulnerability Details CVEID:CVE-2026-40175 DESCRIPTION: Axios i...

Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42264

Summary IBM Edge Data Collector Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42264. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From...

Security Bulletin: IBM Edge Data Collector uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035

Summary IBM Edge Data Collector Component uses uuid-8.3.2.tgz, uuid-9.0.1.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043, CVE-2026-42044. This...

CVE-2026-44495

creationtimestamp| type| source ---|---|--- 2026-05-29 09:05:09+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw 2026-07-01 15:18:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplstfubxd23...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42264

Summary Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42264.This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037

Summary Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026-42043,...

CVE-2026-44494

creationtimestamp| type| source ---|---|--- 2026-05-29 06:49:56+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh 2026-06-03 14:43:57+00:00| published-proof-of-concept| https://t.me/bdufstecru/3216 2026-06-11 18:01:07+00:00| seen|...

CVE-2026-44492

creationtimestamp| type| source ---|---|--- 2026-05-29 06:32:41+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv 2026-06-11 18:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnzsmajacl2n 2026-06-12 12:00:59+00:0...

CVE-2026-44490

creationtimestamp| type| source ---|---|--- 2026-05-29 06:32:22+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg 2026-06-12 12:01:26+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mo3oxs2bzq2k...

CVE-2026-44489

creationtimestamp| type| source ---|---|--- 2026-05-29 06:31:28+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp 2026-06-12 12:01:27+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mo3oxubhy325...

PT-2026-44909

Name of the Vulnerable Software and Affected Versions Axios versions 1.15.2 through 1.15.9 Description Nested objects created by the merge function in utils.js are constructed as plain objects, meaning they retain Object.prototype in their prototype chain. The setProxy function in...