Axios’s Node.js HTTP adapter can incorrectly forward a Proxy-Authorization header to a final destination when a request is redirected from an authenticated proxy to a non-proxied URL. The leaked credential, intended solely for the outbound proxy, is sent to the origin server, exposing sensitive authentication information and potentially permitting unauthorized access or credential compromise. The weakness is a credential mishandling flaw (CWE‑201) that leads to credential disclosure.

Vulnerable Axios versions are 0.x before 0.32.0 and 1.x before 1.16.0 when used in Node.js. Any application that sends HTTP requests through an authenticated proxy and follows redirects that exit the proxy is susceptible.

With a CVSS score of 8.2 the vulnerability is high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that exploitation has not yet been observed. The likely attack vector is inferred from the description: an attacker who can influence the redirect (for example, by controlling the target URL or acting as the proxy) can cause the proxy credentials to be sent to a third‑party site. Because the flaw relies on redirect behavior and the presence of an authenticated proxy chain, the attack requires network access to the affected application and knowledge of its redirect handling. The risk remains significant for deployments that rely on authenticated HTTP proxies and do not suppress or strip proxy headers during redirects.