Insertion of Sensitive Information Into Sent Data in axios - CVE-2026-44487

Vulnerability identifier: #VU133098

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-44487

CWE-ID: CWE-201

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into sent data in the Node.js HTTP adapter when following an HTTP-to-HTTPS redirect from a proxied request to a direct request. A remote attacker can trigger a crafted redirect flow to disclose sensitive information.

Only Node.js requests using the HTTP adapter are affected, and exploitation requires redirects to be followed and proxy credentials to be configured for the initial HTTP request but not for the redirected HTTPS request.

axios
Jira Service Management Data Center
Crowd Data Center
IBM SPSS Collaboration and Deployment Services
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
IBM Security SOAR
Red Hat OpenShift Container Platform
JBoss Data Grid

Install security update from vendor's website.

axios - addressed in versions 0.32.0, 1.16.0
Jira Service Management Data Center - addressed in versions 10.3.23, 11.3.10
Crowd Data Center - update to 7.2.2
IBM SPSS Collaboration and Deployment Services - update to 9.0.0.0.0 IF14
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
Bitbucket Data Center - addressed in versions 9.4.21, 10.2.4, 10.3.1
Jira Software Data Center - addressed in versions 10.3.23, 11.3.7
Bamboo Data Center - addressed in versions 10.2.20, 12.1.8
IBM Security SOAR - update to 51.0.10.2
Red Hat OpenShift Container Platform - addressed in versions 4.14.69, 4.16.65, 4.19.36, 4.20.30, 4.21.25, 4.22.6
JBoss Data Grid - update to 8.6.2

• https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v
• https://github.com/axios/axios/commit/afca61a

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.22
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.21
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.20
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in IBM Security SOAR
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in Crowd Data Center
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center