Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | >= 1.0.0, < 1.16.0, < 0.32.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.16.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
| Debian 12 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.30-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | ansible-core +1 | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.30-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.20-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260715-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-hub +1 | 4.10.16-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.50-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-container | 2.19.12-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.63-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42078 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.0.0, < 1.16.0 | 1.16.0 | GHSA-p92q-9vqr-4j8v |
| npm | axios | < 0.32.0 | 0.32.0 | GHSA-p92q-9vqr-4j8v |
Advisories 7
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-3307 IBM MQ Appliance (Axios Node.js): Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 22, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026