Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix

Description

No description available.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): = 1.15.2
• Patched version(s): 1.16.0

References

• GHSA-654m-c8p4-x5fp
• CVE-2026-44489
• CWE-113
• CWE-1321
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
• Axios: Header Injection via Prototype Pollution - CVE-2026-42035
• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Host Header Injection and Python Tests with SmartScanner 1.11

How do hackers hack websites?

Tags:

npm

axios