Main Vulnerability Database Vulnerabilities #VU132751

Prototype pollution in axios - CVE-2026-44489

Published: May 29, 2026 / Updated: May 29, 2026

Vulnerability identifier: #VU132751

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44489

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation in "setProxy()" function in lib/adapters/http.js. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in data manipulation.

Affected software

axios
IBM Security SOAR

How to mitigate CVE-2026-44489

Install updates from vendor's website.

axios - update to 1.16.0
IBM Security SOAR - update to 51.0.10.2

Links to Public Exploits and PoC-codes

Exploit #12755 - Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix (May 29, 2026)

External References

https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp