Intel

CVE-2026-44489

axios: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') (CVE-2026-44489)

lowEPSS 0.3%

Affected

  • npm/axios 1.15.2..*

Description

Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.

Source: BSI WID PortalBSI CSAFcvelistv5CVE.org (MITRE)OSV (Open Source Vulnerabilities)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

npmaxios
1.15.2

Metrics

XIEM Effective CVSS
3.7
Source: nvd-v3
EPSS percentile
21.3 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
low
Priority score
41.99
Exploit maturity
no public PoC known
CVSS v3
3.7
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-06-11 15:30 UTC
CWE
CWE-113, CWE-1321

Weakness classes (CWE)

  • CWE-113Variant

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

    The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

    cwe.mitre.org →

  • CWE-1321Variant

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

    The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-06-15 16:13 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    • CPE Configuration: OR *cpe:2.3:a:axios:axios:1.15.2:*:*:*:*:node.js:*:*
    • Reference Type: CISA-ADP: https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp Types: Exploit, Vendor Advisory
    • Reference Type: GitHub, Inc.: https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp Types: Exploit, Vendor Advisory