Executive brief
Axios is a popular tool used by developers to make web requests in Node.js applications. A security flaw in its Node.js component allows sensitive proxy login credentials to be accidentally sent to unintended websites during a page redirect. If an attacker lures an application into requesting a malicious link, they could capture the proxy username and password, potentially gaining unauthorized access to the organization's internal network or proxy services.
Technical details
A vulnerability exists in the Axios Node.js HTTP adapter (lib/adapters/http.js) where the 'Proxy-Authorization' header is not cleared during request redirects. When an initial request is made through an authenticated proxy, the 'setProxy()' function attaches the authorization header. If the request is redirected to a target that resolves to a direct connection (e.g., via NO_PROXY or a missing HTTPS_PROXY setting), Axios re-evaluates the proxy settings but fails to remove the existing header. An attacker-controlled server can trigger a redirect to capture these credentials. This issue is fixed in versions 0.32.0 and 1.16.0.
Affected products
- Axios Axios >= 1.0.0, <= 1.15.0; < 0.32.0
Timeline
- 2026-05-30: advisory: GitHub Security Advisory published
- 2026-06-11: disclosed: CVE published to NVD