Axios 1.15.2 lib/adapters/http.js setProxy response splitting

Summaryinfo

A vulnerability was found in Axios 1.15.2. It has been declared as problematic. Affected by this issue is the function setProxy in the library lib/adapters/http.js. The manipulation results in response splitting. This vulnerability is cataloged as CVE-2026-44489. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Axios 1.15.2. Affected is the function setProxy in the library lib/adapters/http.js. The manipulation with an unknown input leads to a response splitting vulnerability. CWE is classifying the issue as CWE-113. The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers. This is going to have an impact on integrity. CVE summarizes:

Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-44489 since 05/06/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.15.2 or 1.16.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Axios

Version

• 1.15.2

Website

• Product: https://github.com/axios/axios/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion