Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8vwd-zh7x-d3dh
Vulnerability ID VCID-8vwd-zh7x-d3dh
Aliases CVE-2026-44489
GHSA-654m-c8p4-x5fp
Summary Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-346 Origin Validation Error
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44489.json
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44489
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44489
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2026-44489
cvssv3.1_qr LOW https://github.com/advisories/GHSA-654m-c8p4-x5fp
cvssv3.1 3.7 https://github.com/axios/axios
generic_textual LOW https://github.com/axios/axios
cvssv3.1 3.7 https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
cvssv3.1_qr LOW https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
generic_textual LOW https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
ssvc Track https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
cvssv3.1 3.7 https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
generic_textual LOW https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
cvssv3.1 3.7 https://nvd.nist.gov/vuln/detail/CVE-2026-44489
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2026-44489
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44489.json
https://api.first.org/data/v1/epss?cve=CVE-2026-44489
https://github.com/axios/axios
https://nvd.nist.gov/vuln/detail/CVE-2026-44489
2487940 https://bugzilla.redhat.com/show_bug.cgi?id=2487940
GHSA-654m-c8p4-x5fp https://github.com/advisories/GHSA-654m-c8p4-x5fp
GHSA-654m-c8p4-x5fp https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
GHSA-q8qp-cvcw-x6jj https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-44489.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/axios/axios
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-11T18:16:53Z/ Found at https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-44489
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09517
EPSS Score 0.00031
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:38:54.733567+00:00 GHSA Importer Import https://github.com/advisories/GHSA-654m-c8p4-x5fp 38.6.0