VYPR
← All advisories
High severity7.0GHSA Advisory· Published Jun 11, 2026· Updated Aug 25, 2026

CVE-2026-44495

CVE-2026-44495

Description

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
axiosnpm
>= 1.0.0, < 1.15.21.15.2
axiosnpm
>= 0.19.0, < 0.31.10.31.1

Affected products

43

Patches

Vulnerability mechanics

References

52

News mentions

1