CVE-2026-44495

HighCVSS 7.7/10Last modified Sep 11, 2026

Description

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-94CWE-1321CWE-915

Affected software

VendorProductVersions
axiosaxios>= 1.0.0, < 1.15.2; >= 0.19.0, < 0.31.1
Red HatRed Hat AMQ Broker 7.13.6—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8—
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 9—
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 9—
Red HatRed Hat Data Grid 8.6.2—
Red Hatmulticluster engine for Kubernetes 2.1—
Red Hatmulticluster engine for Kubernetes 2.6—
Red Hatmulticluster engine for Kubernetes 2.8—
Red Hatmulticluster engine for Kubernetes 2.9—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.11—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat Advanced Cluster Security 4.9—
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.10—
Red HatRed Hat Ansible Automation Platform 2.6—
Red HatRed Hat Ansible Automation Platform 2.7—
Red HatRed Hat Container Native Virtualization 4.13—
Red HatRed Hat Container Native Virtualization 4.14—
Red HatRed Hat Container Native Virtualization 4.15—
Red HatRed Hat Developer Hub 1.10—
Red HatRed Hat Developer Hub 1.9—
Red HatRed Hat Discovery 2—
Red HatRed Hat Migration Toolkit 1.8—
Red HatRed Hat Migration Toolkit for Applications 8.1—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.22—
Red HatRed Hat OpenShift Dev Spaces 3.29—
Red HatRed Hat OpenShift Service Mesh 2.6—
Red HatRed Hat OpenShift Service Mesh 2.6—
Red HatRed Hat OpenShift Service Mesh 3.0—
Red HatRed Hat OpenShift Service Mesh 3.0—
Red HatRed Hat OpenShift Service Mesh 3.1—
Red HatRed Hat OpenShift Service Mesh 3.1—

References

Timeline

Published
Jun 11, 2026
Last modified
Sep 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-444967.5Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x CVE-2026-444979.1ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0 and prior to zebra-script version 6.0.0, the fix for CVE-2026-CVE-2026-444987.5ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, Zebra's block validator undercounts transparent signature operationsCVE-2026-444998.7ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a composite denial-of-service vulnerability in Zebra's block discoveCVE-2026-44508.8Out of bounds write in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crCVE-2026-445005.3ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-networCVE-2026-445017.1DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend (datahub-frontend-react) deserializes attacker-controlleCVE-2026-445024.3Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a miCVE-2026-445037.0The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries faCVE-2026-445048.6Aegra is a drop-in replacement for LangSmith Deployments. Prior to 0.9.7, with multiple authenticated users on a shared instance are vulneraCVE-2026-445055.3Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad gCVE-2026-445068.2Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register
CVE-2026-44495: High severity, CVSS 7.7 | Vulnix