Main Vulnerability Database Vulnerabilities #VU132751

Prototype pollution in axios - CVE-2026-44489

Published: May 29, 2026 / Updated: May 29, 2026

Vulnerability identifier: #VU132751

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44489

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in "setProxy()" function in lib/adapters/http.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in data manipulation.

Affected software

axios
PowerVC
IBM Fusion HCI
IBM MQ Appliance
Data Cataloging
IBM Security SOAR

How to mitigate CVE-2026-44489

Install updates from vendor's website.

axios - update to 1.16.0
IBM Fusion HCI - update to 2.14.0
IBM MQ Appliance - addressed in versions 9.4.0.26, 9.4.5.3, 10.0.0.5
IBM Security SOAR - update to 51.0.10.2
Data Cataloging - update to 2.5.6

Links to Public Exploits and PoC-codes

Exploit #12755 - Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix (May 29, 2026)

External References

https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp