Loading story…
Axios released fixes for two newly disclosed vulnerabilities, CVE-2026-44492 and CVE-2026-44494, affecting its widely used HTTP client for Node.js. The first bug stems from improper normalization of IPv4-mapped IPv6 addresses in shouldBypassProxy, allowing crafted URLs to evade local proxy exclusion logic and potentially reach sensitive targets such as cloud instance metadata services. The second issue is a prototype pollution gadget in Axios’s backend file adapter that can turn existing Object.prototype pollution elsewhere in an application into a man-in-the-middle condition on outbound HTTP requests, exposing or altering traffic and potentially leaking cleartext authentication cookies. Maintainers urged users to upgrade to Axios 1.16.0 or 0.32.0.
The fixes follow earlier Axios proxy-handling problems, including CVE-2026-42043, which bypassed a prior SSRF-related patch by exploiting Axios’s incomplete loopback validation. Researchers showed that Axios treated only localhost, 127.0.0.1, and ::1 as loopback, even though the full 127.0.0.0/8 range is reserved for loopback under RFC 1122, allowing addresses such as 127.0.0.2 to be forwarded through attacker-controlled proxies. That flaw, which could expose internal services, admin interfaces, Docker-bound endpoints, and cloud credential services, was previously fixed in Axios 1.15.1 and 0.31.1, underscoring continuing security concerns around proxy bypass and request-handling logic in the library.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Axios released patches for two vulnerabilities: CVE-2026-44492, a proxy bypass caused by improper normalization of IPv4-mapped IPv6 addresses, and CVE-2026-44494, a prototype pollution gadget in the backend file adapter. Maintainers advised users to upgrade to versions 1.16.0 or 0.32.0.
React Router fixed CVE-2026-42211 in version 7.14.2. The flaw involved insecure deserialization in the vendored turbo-stream v2 logic used by the single-fetch feature in Framework Mode.
A new React Router vulnerability, CVE-2026-42211, was received by GitHub Security Advisories on 2026-06-02. The issue affects React Router 7.0.0 through 7.14.1 in Framework Mode and can enable arbitrary constructor invocation during deserialization.
Axios addressed CVE-2026-42043 by fixing loopback handling in versions 1.15.1 and 0.31.1. The issue concerned incomplete validation of the full 127.0.0.0/8 loopback range.
Researchers Sachin Patil and Amol reported CVE-2026-42043, showing Axios's earlier SSRF-related NO_PROXY patch could be bypassed because it recognized only localhost, 127.0.0.1, and ::1 as loopback addresses. They demonstrated that alternate 127.x.x.x addresses could still be sent through an attacker-controlled proxy.
Axios committed a fix and added tests to ensure stale Proxy-Authorization headers are cleared when redirects no longer use a proxy, when NO_PROXY bypasses an environment-derived proxy, or when a redirect switches to a different proxy. The change is tied to advisory GHSA-j5f8-grm9-p9fc and also hardens related header-handling behavior across header casing variations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvereports.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceinfosecwriteups.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Axios patched several high-severity vulnerabilities affecting its Node.js HTTP adapter, including **CVE-2026-40175**, a critical flaw in versions below `1.13.2` that Singapore's CSA said could enable unauthenticated **SSRF**, potential remote code execution, and full cloud compromise. Separate disclosures also detailed **CVE-2026-42264**, which affects Axios `1.0.0` through `1.15.1` and allows attacker-controlled values inherited from a polluted `Object.prototype` to alter request behavior, enabling credential injection, request redirection, SSRF to Unix sockets, arbitrary code execution during redirects, and weaker HTTP parsing. Axios fixed that issue in `1.15.2` after merging hardening changes into the main branch. A later advisory described **CVE-2026-44494**, another prototype-pollution gadget in Axios's handling of `config.proxy` that affects versions from `1.0.0` up to but not including `1.16.0`, with the `0.x` branch also tracked as affected below `0.32.0`. If an application already contains a separate prototype-pollution source, the flaw can silently route outbound Axios traffic through an attacker-controlled proxy, exposing **Authorization headers, cookies, and request bodies** while allowing forged responses and full man-in-the-middle interception. Axios addressed the issue in `1.16.0`, and a backport commit for the `0.x` line added null-prototype object merging and other hardening measures to reduce prototype-pollution risk.
Jul 10, 2026
A high-severity flaw in the Axios HTTP client, tracked as **`CVE-2026-67320`**, can cause Node.js applications to send requests through an attacker-controlled proxy when the Node HTTP adapter is used and **prototype pollution** has already compromised `Object.prototype`. The issue stems from request configuration hardening being undone by common interceptor patterns such as object spreading or `Object.assign`, allowing a polluted `proxy` property to be inherited through the prototype chain. Affected versions are **`0.31.1` through `0.32.9`** and **`1.15.2` through `1.17.9`**, with fixes released in **`0.33.0`** and **`1.18.0`**. Successful exploitation can expose plaintext HTTP traffic, including **Authorization headers**, Basic auth credentials from `config.auth`, request methods, full URLs, `Host` headers, and request bodies, while also enabling attackers to return manipulated responses to the application. Italian authorities reported that a **proof-of-concept exploit is now publicly available**, increasing the urgency for organizations using vulnerable Axios versions in Node.js environments to patch promptly. The advisory notes there is no demonstrated browser impact and no HTTPS header or body disclosure under normal TLS validation.
Aug 3, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026