Axios CVE-2026-44494 turns prototype pollution into MITM risk for OpenShift users

What happened

Red Hat has published a record for CVE-2026-44494, a flaw in Axios, the widely used JavaScript HTTP client. According to a dev.to write-up summarising the advisory, the vulnerability allows an attacker who has already achieved Object.prototype pollution in an application to escalate that condition into a full man-in-the-middle attack against subsequent Axios requests.

Red Hat rates the issue as Important, with a CVSS 3.1 base score of 8.7 and the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N. The high attack-complexity element reflects the prerequisite pollution primitive rather than the impact, which covers high confidentiality and integrity damage with no availability effect.

The GitHub advisory, as cited in the dev.to article, lists Axios versions 1.0.0 through 1.15.x as affected and names 1.16.0 as the patched release. Red Hat includes OpenShift Container Platform among the products that ship the affected library, and notes that a product marked affected includes all minor releases unless stated otherwise, with fixes delivered through Red Hat errata.

How the attack chain works

The flaw hinges on how Axios resolves proxy settings. The HTTP adapter reads config.proxy from the merged request configuration. Because proxy is not part of Axios's defaults, a configuration object with no own proxy property can still inherit one that an attacker has injected onto Object.prototype. If that inherited value reaches Axios's setProxy() function, it can redirect the request to an attacker-chosen host and port.

A proxy positioned this way can read request headers, credentials, cookies and bodies, and can replace responses. Red Hat's description, as reported by dev.to, states that no direct user interaction is required once the pollution primitive is present. The need for a separate pollution source is what makes the issue conditional rather than directly exploitable.

What an affected listing actually means

The dev.to article stresses that an affected-product listing means Red Hat determined the product ships one or more affected components. It does not mean every cluster is exploitable: the application still needs both a path that pollutes Object.prototype and a later Axios request that inherits the polluted proxy value.

It also draws a line between the platform and customer workloads. Red Hat's errata address the packages Red Hat maintains, but a customer-built Node.js image can bundle its own copy of Axios. Those images must be rebuilt against an updated dependency even after the cluster itself is fully patched.

A verification checklist for OpenShift teams

The article sets out concrete steps:

• Inventory every OpenShift namespace and runtime image digest, then query each final image's package inventory for Axios below 1.16.0. Include applications, jobs, operators and sidecars, and record image owners plus the request paths that use Axios.
• Check the current Red Hat security advisory for the installed OpenShift Container Platform release and apply the errata that include CVE-2026-44494.
• Rebuild application images with Axios 1.16.0 or later and confirm the fixed package is present inside the new image.
• Review object-parsing code for recursive merges and dangerous keys. Rejecting untrusted proto, constructor and prototype keys can reduce exposure, but Red Hat says a supported mitigation is not available, so these checks should not be recorded as a substitute for the errata and package update.

Limited visibility into real-world exposure

For context, the article reports that a ZoomEye search for OpenShift-titled products returned 5,443 matches on 3 November 2026 UTC, while filtering for the CVE returned zero. The author cautions that this is a broad count of product titles, that it cannot be compared with Red Hat's affected-product inventory without further evidence, and that it does not confirm any specific deployment is vulnerable.

Why it matters

The vulnerability is a reminder that CVSS scores describe the worst case, not the typical one. An 8.7 rating sits behind a precondition — prototype pollution — that many applications will never have. But where that precondition does exist, the payoff is complete visibility into outbound HTTP traffic, including credentials and cookies, plus the ability to tamper with responses.

It also highlights a blind spot common to platform-managed environments: Axios travels as a transitive dependency in countless Node.js images, so patching OpenShift itself leaves customer-built workloads untouched. Teams running OpenShift should treat the errata and a full image-by-image dependency inventory as a single combined task rather than two separate ones.