axios Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Request/Response Splitting) Vulnerability - CVE-2026-44489

Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0 nested objects created by utils.merge() (e.g. config.proxy) are still constructed as plain with Object.prototype in their chain. The setProxy() function at lib/adapters/http.js:209-223 reads proxy.username proxy.password and proxy.auth without hasOwnProperty checks. When Object.prototype.username is polluted setProxy() constructs a Proxy-Authorization header with attacker-controlled credentials and injects it into every proxied HTTP request. This vulnerability is fixed in 1.16.0.