How Proxy-Authorization Header Leakage Happens in Axios and How to Fix It

Introduction

In a client application's dependency tree, we discovered a high-severity information disclosure vulnerability in Axios 1.15.2 that could expose proxy authentication credentials to unintended servers. The vulnerability, tracked as CVE-2026-44486, exists in the client/package-lock.json dependency manifest where Axios was pinned at version 1.15.2. When an HTTP request configured to use a proxy server encounters a redirect, and Axios re-evaluates the connection to bypass the proxy for the redirect target, the Proxy-Authorization header—containing sensitive credentials—was not stripped from the outgoing request. This meant that proxy usernames and passwords could be leaked to arbitrary third-party servers during redirect chains.

The vulnerable dependency was identified by Trivy scanner, which flagged the specific pattern where proxy credentials could be disclosed through HTTP redirects. The fix involved upgrading Axios from version 1.15.2 to 1.18.0 across both client/package.json and client/pnpm-lock.yaml, ensuring the HTTP client properly sanitizes proxy-specific headers during connection re-evaluation.

The Vulnerability Explained

The Proxy-Authorization header is used to authenticate with HTTP proxy servers. It typically contains credentials in the format Basic base64(username:password). In normal operation, this header should only be sent to the proxy server itself, never to the final destination server.

Here's what happened in Axios 1.15.2:

1. A client application makes an HTTP request through a configured proxy server
2. The request includes a Proxy-Authorization header with credentials
3. The proxy server responds with an HTTP redirect (301, 302, 307, 308)
4. Axios re-evaluates the connection and determines the redirect target doesn't require proxying
5. The vulnerability: Axios switches to a direct connection but fails to remove the Proxy-Authorization header
6. The sensitive proxy credentials are sent directly to the redirect target server

Looking at the dependency configuration before the fix:

"axios": "^1.14.0",

And in the lock file:

axios:
  specifier: ^1.14.0
  version: 1.15.2

The application was using Axios 1.15.2, which contained the vulnerable redirect handling logic. When the HTTP client processed redirects and switched from proxied to direct connections, it didn't properly sanitize the header collection.

Real-World Attack Scenario

Consider this attack scenario specific to the client application:

1. An attacker controls a web service that the client application might interact with (perhaps through user-supplied URLs or API integrations)
2. The client application runs behind a corporate proxy requiring authentication
3. The attacker's service returns an HTTP 302 redirect to a domain under their control
4. When Axios follows the redirect and determines it doesn't need the proxy for the new destination, it switches to a direct connection
5. The Proxy-Authorization header (containing corporate proxy credentials) is sent to the attacker's server
6. The attacker now has valid proxy credentials that could be used to:
   - Access internal resources through the corporate proxy
   - Pivot to other internal systems
   - Mask malicious traffic as legitimate by using stolen proxy credentials

The impact is particularly severe in environments where:
- Proxy credentials grant access to sensitive internal networks
- The same proxy credentials are shared across multiple users or services
- Proxy logs are used for security monitoring (stolen credentials could enable undetected access)

The Fix

The fix involved upgrading Axios to version 1.18.0, which includes proper header sanitization during redirect handling. Here's what changed:

Before (client/package.json):

"dependencies": {
  "@stellar/freighter-api": "^6.0.1",
  "axios": "^1.14.0",
  "chart.js": "^4.5.1",
  // ... other dependencies
}

After (client/package.json):

"dependencies": {
  "@stellar/freighter-api": "^6.0.1",
  "axios": "^1.18.0",
  "chart.js": "^4.5.1",
  // ... other dependencies
}

Before (client/pnpm-lock.yaml):

axios:
  specifier: ^1.14.0
  version: 1.15.2

After (client/pnpm-lock.yaml):

axios:
  specifier: ^1.18.0
  version: 1.18.0

The upgrade from 1.15.2 to 1.18.0 brings in the security fix that was introduced in Axios 1.16.0. The updated version includes logic that:

1. Tracks connection type changes: Monitors when a request transitions from proxied to direct connection
2. Identifies proxy-specific headers: Recognizes headers like Proxy-Authorization that should only be sent to proxies
3. Sanitizes headers during redirects: Removes proxy-specific headers when following redirects to direct connections
4. Preserves valid headers: Maintains other authentication headers (like Authorization) that are legitimately intended for the destination server

The fix required changes to both files because:
- package.json defines the acceptable version range for the dependency
- pnpm-lock.yaml pins the exact resolved version and ensures reproducible builds

By updating both files, the fix ensures that:
- New installations will get Axios 1.18.0 or later
- Existing installations will upgrade to the secure version on next pnpm install
- The lock file prevents accidental downgrades to vulnerable versions

Prevention & Best Practices

To avoid similar vulnerabilities in your applications:

1. Implement Header Allowlisting for Redirects

When following HTTP redirects, explicitly define which headers should be forwarded:

// Define safe headers for cross-origin redirects
const SAFE_REDIRECT_HEADERS = [
  'accept',
  'accept-language',
  'content-type',
  'user-agent'
];

// Never forward authentication headers across origins
const SENSITIVE_HEADERS = [
  'authorization',
  'proxy-authorization',
  'cookie',
  'x-api-key'
];

2. Regular Dependency Audits

Use automated tools to scan for known vulnerabilities:

# Using npm
npm audit

# Using pnpm
pnpm audit

# Using Trivy for comprehensive scanning
trivy fs --scanners vuln .

3. Principle of Least Privilege for Headers

Only include necessary headers in requests:

// Bad: Forwarding all headers
axios.get(redirectUrl, { headers: originalRequest.headers });

// Good: Selective header forwarding
const safeHeaders = filterSafeHeaders(originalRequest.headers);
axios.get(redirectUrl, { headers: safeHeaders });

4. Monitor for Credential Exposure

Implement logging and monitoring to detect potential credential leakage:

// Log outgoing headers in development (sanitized in production)
axios.interceptors.request.use(request => {
  if (process.env.NODE_ENV === 'development') {
    const sensitiveHeaders = Object.keys(request.headers)
      .filter(h => h.toLowerCase().includes('auth'));
    if (sensitiveHeaders.length > 0) {
      console.warn(`Sending auth headers to: ${request.url}`);
    }
  }
  return request;
});

5. Security Standards Compliance

Follow OWASP recommendations:
- OWASP Top 10 A07:2021 - Identification and Authentication Failures
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
- CWE-359 - Exposure of Private Personal Information to an Unauthorized Actor

6. Dependency Version Pinning Strategy

Balance security and stability:

{
  "dependencies": {
    // Use caret for patch updates, but review minor/major updates
    "axios": "^1.18.0",  // Allows 1.18.x, blocks 1.17.x and below
  },
  "overrides": {
    // Force minimum secure versions for transitive dependencies
    "axios": ">=1.16.0"
  }
}

Key Takeaways

• Axios versions before 1.16.0 leak Proxy-Authorization headers when switching from proxied to direct connections during HTTP redirects, exposing proxy credentials to redirect targets
• The client application's dependency on Axios 1.15.2 in client/package-lock.json created a direct path for credential disclosure through the HTTP client's redirect handling
• Upgrading to Axios 1.18.0 eliminates the vulnerability by implementing proper header sanitization that strips proxy-specific authentication from requests during connection re-evaluation
• Both package.json and pnpm-lock.yaml required updates to ensure the secure version is enforced across all installations and prevent version drift back to vulnerable releases
• Trivy scanner successfully detected this CVE-2026-44486 pattern in the dependency manifest, demonstrating the value of automated vulnerability scanning in CI/CD pipelines

How Orbis AppSec Detected This

• Source: Axios dependency declaration in client/package.json and resolved version in client/package-lock.json
• Sink: Axios HTTP client redirect handling logic that forwards headers during proxy-to-direct connection transitions
• Missing control: Header sanitization during connection type re-evaluation; Proxy-Authorization headers were not stripped when switching from proxied to direct connections during redirects
• CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
• Fix: Upgraded Axios from 1.15.2 to 1.18.0, which includes the security patch that properly removes proxy-specific headers during redirect flows

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-44486 demonstrates how subtle flaws in HTTP client redirect handling can lead to serious information disclosure vulnerabilities. The leakage of Proxy-Authorization headers during connection re-evaluation could expose corporate proxy credentials to malicious third parties, enabling unauthorized access to internal networks and resources. By upgrading Axios from 1.15.2 to 1.18.0, the client application now properly sanitizes proxy-specific headers during redirects, preventing credential leakage.

This vulnerability underscores the importance of keeping HTTP client libraries up to date and implementing defense-in-depth strategies for handling sensitive authentication data. Regular dependency audits, automated vulnerability scanning, and careful header management during redirects are essential practices for maintaining secure applications. Always treat authentication credentials—whether for proxies, APIs, or services—as highly sensitive data that requires explicit protection at every layer of your application.

References

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• OWASP Authentication Cheat Sheet
• Axios Security Documentation
• Semgrep Rules for Header Leakage
• fix: upgrade axios to 1.16.0, 0.32.0 (CVE-2026-44486)