Prototype pollution in axios - CVE-2026-44494

Vulnerability identifier: #VU132750

CSH Severity: High

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44494

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in config.proxy. A remote attacker can pass specially crafted input to the application and perform a man-in-the-middle (MitM) attack, which can result in information disclosure or data manipulation.

axios
PowerVC
IBM Fusion HCI
Jira Service Management Data Center
Crowd Data Center
IBM SPSS Collaboration and Deployment Services
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
DataStage on Cloud Pak for Data
IBM MQ Appliance
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App
IBM Security SOAR
Red Hat OpenShift Container Platform
JBoss Data Grid

Install updates from vendor's website.

axios - update to 1.16.0
IBM Fusion HCI - update to 2.14.0
DataStage on Cloud Pak for Data - addressed in versions 5.3.1 patch 8, 5.4 patch 5
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.10
Crowd Data Center - update to 7.2.2
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF14
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM MQ Appliance - addressed in versions 9.4.0.26, 9.4.5.3, 10.0.0.5
Bitbucket Data Center - addressed in versions 9.4.21, 10.2.4, 10.3.1
Jira Software Data Center - addressed in versions 10.3.23, 11.3.7
Bamboo Data Center - addressed in versions 10.2.20, 12.1.8
IBM Security SOAR - update to 51.0.10.2
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
Red Hat OpenShift Container Platform - addressed in versions 4.14.69, 4.16.65, 4.19.36, 4.20.27, 4.20.30, 4.21.25, 4.22.4
JBoss Data Grid - update to 8.6.2

• Exploit #12753 - Prototype Pollution Gadget in Axios Node Proxy Handling (May 29, 2026)

• https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in IBM Security SOAR
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Crowd Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM DataStage on Cloud Pak for Data
• Multiple vulnerabilities in IBM MQ Appliance
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM PowerVC
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging