Loading story…
Two high-severity flaws affecting widely used JavaScript packages were disclosed and patched, exposing Node.js applications to file-system escape and HTTP traffic interception risks. In tmp 0.2.6, CVE-2026-49982 allows path traversal through type confusion in the internal _assertPath guard: non-string values such as arrays, buffers, or crafted objects can bypass checks for .. and later stringify into traversal paths, letting files or directories be created outside the intended temporary directory. The issue affects applications that pass untrusted data into APIs including tmp.file, tmp.dir, and related synchronous and temporary-name functions, and it is fixed in tmp 0.2.7.
A separate flaw in Axios, tracked as CVE-2026-44494, affects versions 1.0.0 through before 1.16.0 and turns existing Object.prototype pollution elsewhere in an application into a full man-in-the-middle condition. Because Axios reads config.proxy through normal prototype-chain property access and does not define proxy as an own property by default, an attacker who can poison the prototype can force requests through an attacker-controlled proxy, exposing and altering HTTP traffic and credentials. Axios fixed the issue in 1.16.0, while reporting on the tmp bug noted a CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L and warned that raw JSON bodies or complex query objects passed directly into library options increase exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Axios versions 1.0.0 through before 1.16.0 were found vulnerable to a prototype pollution gadget in config.proxy that could escalate existing Object.prototype pollution into a man-in-the-middle attack. The flaw was fixed in Axios version 1.16.0.
A path traversal vulnerability in tmp 0.2.6 allowed non-string values to bypass the _assertPath guard and create files or directories outside the intended temporary directory. The issue was fixed in tmp version 0.2.7 by enforcing string validation before traversal checks.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Axios released fixes for two newly disclosed vulnerabilities, **CVE-2026-44492** and **CVE-2026-44494**, affecting its widely used HTTP client for Node.js. The first bug stems from improper normalization of IPv4-mapped IPv6 addresses in `shouldBypassProxy`, allowing crafted URLs to evade local proxy exclusion logic and potentially reach sensitive targets such as cloud instance metadata services. The second issue is a prototype pollution gadget in Axios’s backend file adapter that can turn existing `Object.prototype` pollution elsewhere in an application into a man-in-the-middle condition on outbound HTTP requests, exposing or altering traffic and potentially leaking cleartext authentication cookies. Maintainers urged users to upgrade to **Axios 1.16.0** or **0.32.0**. The fixes follow earlier Axios proxy-handling problems, including **CVE-2026-42043**, which bypassed a prior SSRF-related patch by exploiting Axios’s incomplete loopback validation. Researchers showed that Axios treated only `localhost`, `127.0.0.1`, and `::1` as loopback, even though the full `127.0.0.0/8` range is reserved for loopback under RFC 1122, allowing addresses such as `127.0.0.2` to be forwarded through attacker-controlled proxies. That flaw, which could expose internal services, admin interfaces, Docker-bound endpoints, and cloud credential services, was previously fixed in **Axios 1.15.1** and **0.31.1**, underscoring continuing security concerns around proxy bypass and request-handling logic in the library.
Jun 29, 2026
Axios patched several high-severity vulnerabilities affecting its Node.js HTTP adapter, including **CVE-2026-40175**, a critical flaw in versions below `1.13.2` that Singapore's CSA said could enable unauthenticated **SSRF**, potential remote code execution, and full cloud compromise. Separate disclosures also detailed **CVE-2026-42264**, which affects Axios `1.0.0` through `1.15.1` and allows attacker-controlled values inherited from a polluted `Object.prototype` to alter request behavior, enabling credential injection, request redirection, SSRF to Unix sockets, arbitrary code execution during redirects, and weaker HTTP parsing. Axios fixed that issue in `1.15.2` after merging hardening changes into the main branch. A later advisory described **CVE-2026-44494**, another prototype-pollution gadget in Axios's handling of `config.proxy` that affects versions from `1.0.0` up to but not including `1.16.0`, with the `0.x` branch also tracked as affected below `0.32.0`. If an application already contains a separate prototype-pollution source, the flaw can silently route outbound Axios traffic through an attacker-controlled proxy, exposing **Authorization headers, cookies, and request bodies** while allowing forged responses and full man-in-the-middle interception. Axios addressed the issue in `1.16.0`, and a backport commit for the `0.x` line added null-prototype object merging and other hardening measures to reduce prototype-pollution risk.
Jul 10, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026