SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2026-44495

If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator.

HIGH 7.7EPSS 0.84%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.84%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.

CVSS 3.1
7.7 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H
EPSS
0.84% probability · 56th percentile
CISA KEV
Not listed
Weakness
CWE-94, CWE-1321, CWE-915
Affected
axios/axios · redhat/advanced cluster management for kubernetes · redhat/advanced cluster security · redhat/ansible automation platform · redhat/data grid · redhat/developer hub · redhat/discovery · redhat/openshift container platform · redhat/openshift dev spaces · redhat/openshift service mesh · redhat/openshift virtualization · redhat/quay
Source
security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.