PatchSiren cyber security CVE debrief

CVE-2026-44494 axios CVE debrief

Axios, a promise-based HTTP client for the browser and Node.js, is vulnerable to a Prototype Pollution 'Gadget' attack. This vulnerability, tracked as CVE-2026-44494, allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack. This enables attackers to intercept, read, and modify all HTTP traffic, including authentication credentials. The vulnerability exists due to how the HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This issue affects Axios versions from 1.0.0 to before 1.16.0. The vulnerability is fixed in version 1.16.0.