CVE-2026-44486: Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Synopsis

This is a sensitive-header-leak vulnerability in the Axios HTTP client library (Node.js adapter). When a request is routed through an authenticated proxy and Axios follows a redirect that resolves to a direct connection (bypassing the proxy), the Proxy-Authorization header is not stripped before the redirected request is sent, exposing proxy credentials to the redirect target server. Successful exploitation allows an attacker-controlled or compromised redirect target to read the proxy credentials in cleartext. No patched upstream release is currently published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected service must be reachable over the network; an attacker controls or compromises a server that acts as a redirect target to receive the leaked header.

• AuthenticationNot required

  No authentication against the vulnerable Axios-based application is required; the attacker only needs to be in a position to receive the redirected HTTP request.

• Victim interactionNot required

  No user or victim interaction is needed; the leak happens automatically when Axios follows a redirect during normal HTTP operation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the attacker simply needs to control or observe the redirect target server, with no race conditions or special memory layout required.

Blast Radius

• The redirect target server receives the raw Proxy-Authorization header value, exposing the proxy credentials (typically a username and password encoded in Base64) in the HTTP request headers.
• An attacker holding those proxy credentials can authenticate to the organization's proxy infrastructure and route arbitrary traffic through it, potentially reaching internal network segments.
• Proxy credential exposure may allow pivoting to other internal services or systems that trust traffic originating from the corporate proxy.