{"schema_version":"1.9.0","id":"CVE-2026-44495","published":"2026-06-11T15:33:12.433Z","modified":"2026-09-09T03:30:54.367532863Z","aliases":["GHSA-3g43-6gmg-66jw"],"summary":"Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge","details":"Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/axios/axios","events":[{"introduced":"8d0b92b2678d96770304dd767cd05a59d37f12cf"},{"fixed":"a589dc525af12e0fabef7d6e5be028ad433eee31"},{"introduced":"484aa4fe6addccbd32206a31eb3d2d000843066e"},{"fixed":"582934382e4e0e0bcb679c628071a4203e93cf57"}],"database_specific":{"cpe":"cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*","extracted_events":[{"introduced":"0.19.0"},{"fixed":"0.31.1"},{"introduced":"1.0.0"},{"fixed":"1.15.2"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/stackrox/stackrox","events":[{"introduced":"0"},{"fixed":"b23078af54688f8c6ab5ebe707d805f933dc9e73"}],"database_specific":{"cpe":"cpe:2.3:a:redhat:advanced_cluster_security:*:*:*:*:*:kubernates:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.10.3"}],"source":"CPE_RANGE"}}],"versions":["v1.15.1","v0.31.0","v1.15.0","v1.14.0","v1.13.6","v0.30.3","v0.30.2","v1.13.5","v1.13.4","v1.13.3","v1.13.2","v1.13.1","v1.13.0","v0.30.1","v1.12.2","v1.12.1","v1.12.0","v0.30.0","v1.11.0","v1.10.0","v1.9.0","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v0.29.0","v1.7.9","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v0.28.1","v1.7.1","v1.7.0","v1.7.0-beta.2","v1.7.0-beta.1","v1.7.0-beta.0","v1.6.8","v1.6.7","v0.28.0","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.0","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","1.2.2","v1.2.1","v1.2.0","1.2.0-alpha.1","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.0","v0.27.2","v0.27.1","v0.27.0","v0.26.0","v0.26.1","v0.25.0","v0.24.0","v0.23.0","0.21.3","v0.21.2","v0.21.0","v0.20.0","v0.20.0-0","v0.19.2","0.19.1","v0.19.1","v0.19.0","4.10.3-rc.1","4.10.3-rc.0","4.10.2","4.10.2-rc.2","4.10.2-rc.1","4.10.2-rc.0","4.10.1","4.10.1-rc.11","4.10.1-rc.1","4.10.1-rc.0","4.10.0","4.10.0-rc.7","4.10.0-rc.6","4.10.0-rc.5","4.10.0-rc.4","4.10.0-rc.3","4.10.0-rc.2","4.10.0-rc.1","4.10.0-rc.0","4.10.x","9.x","4.9.x","4.9","8.x","4.8.x","4.8","7.x","4.7.x","4.7","6.x","4.6.x","4.6","4.x","4.4.x","4.4","4.3.x","4.3","3.x","4.2.x","4.2","2.x","4.1.x","4.0.x","3.74.x","3.73.x","3.72.x","3.71.x","3.70.x","3.69.x","3.68.x","3.67.x","3.65.x"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44495.json"}}],"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44495.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20938"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27044"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28964"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29082"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30650"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33155"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33160"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33163"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33173"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33183"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34160"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34374"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36108"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36754"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36883"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40262"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40768"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40792"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41031"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41055"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41064"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41066"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42142"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42146"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43052"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46885"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:46903"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50300"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53840"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54188"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54555"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57191"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59833"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-44495"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44495.json"},{"type":"ADVISORY","url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1321","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44495.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L"}]}