Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Description

No description available.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

Affected version(s): **< 0.31.0 >= 1.0.0, < 1.15.0**
Patched version(s): **0.31.0 1.15.0**

References

Could your website be exposed too?

SmartScanner can check your website for Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain and gives you actionable findings to investigate.

Start a free scan

Related Issues

Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
Axios: Header Injection via Prototype Pollution - CVE-2026-42035
SillyTavern has Authentication Bypass via SSO Header Injection - CVE-2026-44649

How do hackers hack websites?

Host Header Injection and Python Tests with SmartScanner 1.11

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated May 20, 2026