Description
Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **<= 0.31.1 >= 1.0.0, < 1.16.0** Patched version(s): **0.32.0 1.16.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
You might also like:
See something that needs correcting? Let us knowUpdated June 12, 2026