CVE-2026-44489

A flaw was found in Axios, a promise-based HTTP client. A remote attacker could exploit a prototype pollution vulnerability, which occurs when nested objects are created without proper checks, allowing an attacker to inject malicious properties into Object.prototype. This vulnerability specifically affects the setProxy() function, which, when processing proxy credentials, fails to validate if properties like username or password belong to the object itself. Consequently, attacker-controlled credentials can be injected into Proxy-Authorization headers, potentially leading to information disclosure in proxied HTTP requests.