{"schemaVersion":3,"id":"CVE-2026-44489","aliases":["UBUNTU-CVE-2026-44489","DEBIAN-CVE-2026-44489","CGA-4c9w-x3vq-q6vf","CGA-4pvv-5c8r-5m7v","CGA-5m56-jv8q-c873","CGA-5qqm-pqg7-cf48","CGA-8xr6-5398-7p5j","CGA-9c96-m5h2-224r","CGA-c3vc-mvhh-c7r9","CGA-cjr2-vwp2-9mwx","CGA-f3mx-v9vh-jc92","CGA-g72c-cmjm-qcc8","CGA-g86v-w99p-jh28","CGA-gq3p-gm4w-5w37","CGA-gr6g-63m5-jvwx","CGA-j8hh-28p5-gc63","CGA-m5cw-wcp5-6xgv","CGA-mmvw-v7r4-g38h","CGA-xh42-fpgv-wfw4","GHSA-654m-c8p4-x5fp","CGA-2jqq-q5px-4xvr","CGA-3694-c26j-vrqj","CGA-3hgv-pw5f-2w7v","CGA-3phv-6g3g-4mfg","CGA-472h-h29j-jw9p","CGA-4865-9f45-f27j","CGA-4v84-844g-8frw","CGA-597j-7ww2-85g2","CGA-5gc8-mm4r-h285","CGA-64wj-rgr9-gcf5","CGA-682h-fqm6-4r47","CGA-7g8c-w5w9-6w3v","CGA-7hrj-cq6p-r468","CGA-8c94-24g8-w4f8","CGA-8g3p-chvq-35c3","CGA-8x33-94mf-c29j","CGA-943q-8vm7-hhrg","CGA-95j2-gv4r-fc9c","CGA-977g-fwm3-9fh9","CGA-9fj6-jghv-h34c","CGA-9fmv-q92m-rrcv","CGA-9mxr-85gp-6qr6","CGA-9pj7-fm4h-p4c5","CGA-9qg4-vp8c-jg3g","CGA-9wcw-5wx3-hr6g","CGA-cv93-w8x2-69fv","CGA-fm6x-xw3g-9hw5","CGA-gjf4-8xmm-f7vc","CGA-gxw2-4jr3-hw66","CGA-h5vj-c5wm-v752","CGA-h7c9-33h2-hq6w","CGA-j8vv-jjhh-39r3","CGA-jf8j-67jr-9mqf","CGA-jwr8-2jhw-2gv6","CGA-m4mc-24vh-4q6m","CGA-mhrv-mqrh-8pg3","CGA-mp4x-2pjc-w8w4","CGA-phf9-v3pq-437x","CGA-pwrw-jrj2-vm5g","CGA-q5h8-wwqf-w8p3","CGA-r4jc-68fv-gm38","CGA-rjc7-px5p-rcx6","CGA-rppm-r267-m95h","CGA-v857-x5xr-7r27","CGA-vcxf-9xmc-558f","CGA-vjjx-2wc4-mc7g","CGA-vm54-mrrf-x572","CGA-vvh5-f8gf-9c8w","CGA-wjrj-p2q5-mhjx","CGA-x298-6pw2-pfmj","CGA-xcxm-mrc7-7hch","CGA-xffm-rfgf-r5m2"],"status":"published","duplicateOf":null,"title":null,"description":"Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username, proxy.password, and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted, setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.","dates":{"published":"2026-06-11T15:30:44.798Z","modified":"2026-06-11T18:17:09.112Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00305,"percentile":0.21827,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.069,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00236},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00305,"percentile":0.21827}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00236,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00305,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00305,"percentile":0.21827}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_AXIOS_AXIOS","name":"Axios","source":"github","url":"https://github.com/axios/axios/issues/1098","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-113","name":"Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","description":"The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/113.html"},{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"jitsucom-jitsu-console","name":"jitsucom-jitsu-console","label":"jitsucom-jitsu-console","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jitsucom-jitsu-console","purlType":"apk","versions":[{"text":"< 2.11.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17","name":"kibana-8.17","label":"kibana-8.17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17","purlType":"apk","versions":[{"text":"< 8.17.10-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-bitnami","name":"kibana-8.17-bitnami","label":"kibana-8.17-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-bitnami","purlType":"apk","versions":[{"text":"< 8.17.10-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-iamguarded","name":"kibana-8.17-iamguarded","label":"kibana-8.17-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-iamguarded","purlType":"apk","versions":[{"text":"< 8.17.10-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.16-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.16-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.16-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r26","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r26","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r19","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2","name":"langfuse-2","label":"langfuse-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2","purlType":"apk","versions":[{"text":"< 2.95.12-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2","name":"langfuse-fips-2","label":"langfuse-fips-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2","purlType":"apk","versions":[{"text":"< 2.95.12-r27","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r27","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r27","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r27","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.6-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.6-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.6.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.0-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3-fips","name":"opensearch-dashboards-3-fips","label":"opensearch-dashboards-3-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips","purlType":"apk","versions":[{"text":"< 3.6.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.0-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"unleash","name":"unleash","label":"unleash","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/unleash","purlType":"apk","versions":[{"text":"< 7.6.4-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.6.4-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jitsucom-jitsu-console","name":"jitsucom-jitsu-console","label":"jitsucom-jitsu-console","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jitsucom-jitsu-console","purlType":"apk","versions":[{"text":"< 2.11.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.0-r25","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r22","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.177.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.177.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"lerna","name":"lerna","label":"lerna","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/lerna","purlType":"apk","versions":[{"text":"< 9.0.7-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.7-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.6.0-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.0-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r1","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"axios","product":"axios","name":"axios","label":"axios","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.15.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.15.2","eol":null,"hubHref":"/vendor/axios/axios"},{"vendor":"debian","product":"node-axios","name":"node-axios","label":"node-axios","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-axios","purlType":"deb","versions":[{"text":"< 1.16.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-axios","name":"node-axios","label":"node-axios","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-axios","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"axios","name":"axios","label":"axios","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/axios","purlType":"npm","versions":[{"text":"≥ 1.15.2, < 1.16.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.15.2, < 1.16.0","eol":null,"hubHref":null}],"affectedCount":44,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp","label":"github.com/axios/axios/security/advisories/GHSA-654m-c8p4-x5fp","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44489","label":"ubuntu.com/security/CVE-2026-44489","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44489","label":"www.cve.org/CVERecord?id=CVE-2026-44489","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44489","label":"security-tracker.debian.org/tracker/CVE-2026-44489","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44489.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44489.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44489","label":"nvd.nist.gov/vuln/detail/CVE-2026-44489","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj","label":"github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/axios/axios","label":"github.com/axios/axios","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-7VG9-5766-FMWH"]},"timeline":[{"kind":"published","date":"2026-06-11T15:30:44.798Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-11T18:17:09.112Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:20:49.479Z","stale":false,"partial":false}}