GHSA-p92q-9vqr-4j8v · Severity: high · Ecosystem: npm — Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
Conclusion & alert: CVE-2026-44487 is rated High Exploit Risk (64.5/100): CVSS High severity, with low exploitation likelihood (EPSS 0.66%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-30 | 0.43% | 0.66% | +0.23% |
| 2 | 2026-06-15 | 0.04% | 0.43% | +0.39% |
| 3 | 2026-06-12 | — | 0.04% | — |
Full EPSS history (3 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.2 | 4.0 | HIGH |
|
— | — | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
GHSA-p92q-9vqr-4j8v · Severity: high · Ecosystem: npm — Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-44487 not yet assigned priority: Debian including 1 source packages (node-axios), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. | https://security-tracker.debian.org/tracker/CVE-2026-44487 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-44487 |
suse
|
high | CVE-2026-44487 severity important: SUSE including 57 source package names (cockpit, cockpit-bridge, …), 257 product×package rows across 28 product lines (SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS, … (28 product lines)): Known Not Affected 257. | https://www.suse.com/security/cve/CVE-2026-44487/ |