Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489

Description

No description available.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

Affected version(s): = 1.15.2
Patched version(s): 1.16.0

References

Could your website be exposed too?

SmartScanner can check your website for Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix and gives you actionable findings to investigate.

Start a free scan

Related Issues

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
Axios: Header Injection via Prototype Pollution - CVE-2026-42035
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Host Header Injection and Python Tests with SmartScanner 1.11

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated June 12, 2026