CVE-2026-44490

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, known as prototype pollution, allows an upstream dependency to modify the fundamental behavior of JavaScript objects. When this occurs, Axios can unknowingly incorporate these altered values, leading to two potential consequences. This can result in sensitive information being inadvertently included in network requests, or cause application instability and crashes, leading to a denial of service.

This Moderate impact flaw in Axios, a JavaScript HTTP client, affects Red Hat products that integrate vulnerable versions and are susceptible to prototype pollution from other dependencies. Exploitation could lead to sensitive information disclosure in network requests or result in application instability and denial of service, particularly in environments where Object.prototype is modified by other components.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.