Prototype pollution in axios - CVE-2026-44494

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU132750

Prototype pollution in axios - CVE-2026-44494

Published: May 29, 2026


Vulnerability identifier: #VU132750
CSH Severity: High
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44494
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in config.proxy. A remote attacker can pass specially crafted input to the application and perform a man-in-the-middle (MitM) attack, which can result in information disclosure or data manipulation.


Affected software

axios
Jira Service Management Data Center
Crowd Data Center
IBM SPSS Collaboration and Deployment Services
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
IBM Security SOAR
Red Hat OpenShift Container Platform
JBoss Data Grid

How to mitigate CVE-2026-44494

Install updates from vendor's website.

axios - update to 1.16.0
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.10
Crowd Data Center - update to 7.2.2
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF14
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Bitbucket Data Center - addressed in versions 9.4.21, 10.2.4, 10.3.1
Jira Software Data Center - addressed in versions 10.3.23, 11.3.7
Bamboo Data Center - addressed in versions 10.2.20, 12.1.8
IBM Security SOAR - update to 51.0.10.2
Red Hat OpenShift Container Platform - addressed in versions 4.14.69, 4.16.65, 4.19.36, 4.20.27, 4.20.30, 4.21.25, 4.22.4
JBoss Data Grid - update to 8.6.2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins