Search: CVE-2026-44495

Axios versions from 0.19.0 up to but not including 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request configuration processing. This vulnerability does not create prototype pollution itself but can be exploited if another vulnerability has already polluted Object.prototype. Exploitability requires prior attacker control over Object.prototype before Axios processes a request. The issue is fixed in versions 0.31.1 and 1.15.2.