Description
Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch.
Recent axios releases harden merged request config by creating a null-prototype object.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.15.2, < 1.18.0 >= 0.31.1, < 0.33.0** Patched version(s): **1.18.0 0.33.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- Axios HTTP/2 Session Cleanup State Corruption Vulnerability - CVE-2026-39865
- Axios: Nested axios option objects can consume polluted prototype values - Vulnerability
- Axios: HTTP/2 streamed uploads bypass `maxBodyLength` - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026