CVE-2026-44487: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Synopsis

This is a credential leak vulnerability in the Axios Node.js HTTP client. When an application sends a request through an authenticated HTTP proxy and that request is redirected to an HTTPS origin that bypasses the proxy, Axios may forward the Proxy-Authorization header to the destination server, exposing credentials that were intended only for the proxy. Successful exploitation allows a network-positioned attacker to intercept or log those proxy credentials, enabling further unauthorized access. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on the network to observe or intercept traffic between the Axios client and the destination origin server over the network.

• AuthenticationNot required

  No authentication is needed; the attacker passively receives or intercepts the leaked Proxy-Authorization header without any credential of their own.

• Victim interactionNot required

  No user or victim action is required; the credential leak occurs automatically as part of the redirect-following behavior in the Axios HTTP adapter.

• Attack complexityDetail

  Although the exploit itself is reliable once in position, a specific redirect shape must be present (an HTTP-to-HTTPS proxy-to-direct redirect) making environmental conditions a factor.

Blast Radius

• An attacker who receives the leaked Proxy-Authorization header gains the plaintext or encoded credentials used to authenticate to the organization's outbound HTTP proxy.
• With those proxy credentials, the attacker can authenticate to the proxy independently, routing arbitrary traffic through it and potentially pivoting to internal services reachable via that proxy.
• Confidentiality of the affected requests is compromised; no data integrity or availability impact is introduced by this vulnerability.