CVE-2026-44494 high severity vulnerability in `axios`

Current behavior

Trivy reports the high severity vulnerability CVE-2026-44494 (GHSA-35jp-ww65-95wh) in the Docker image cypress/included:<TAG> current latest, referring to

• [email protected]

This is also listed in the GitHub Advisory Database (https://github.com/advisories/GHSA-35jp-ww65-95wh), rated High / 8.7.

axios is a dependency of Cypress and is bundled inside the binary cache, so it is not visible to npm audit in a consumer project — only filesystem and container scanners report it.

Desired behavior

There should be no high severity vulnerabilities reported in cypress/included:latest.

Test code to reproduce

trivy image --ignore-unfixed --pkg-types library --scanners vuln --severity HIGH,CRITICAL cypress/included:<TAG>

Cypress Version

<VERSION>

Node version

<NODE VERSION>

Operating System

<OS>

Debug Logs

<PASTE TRIVY OUTPUT — should include the path
root/.cache/Cypress/<VERSION>/Cypress/resources/app/node_modules/axios/package.json>

Other

[email protected] is required to remediate CVE-2026-44494. The HTTP adapter reads config.proxy via standard property access, which traverses the prototype chain; because proxy is absent from the axios defaults it can be injected via prototype pollution, after which setProxy() routes all requests through an attacker-controlled proxy.

Upgrading to [email protected] would also address the following, all of which affect 1.15.2:

• CVE-2026-44492 — NO_PROXY bypass via unnormalised IPv4-mapped IPv6 addresses (fixed in 0.32.0 and 1.16.0)
• CVE-2026-44490 — two read-side prototype-pollution gadgets in lib/utils.js and lib/core/mergeConfig.js (fixed in 0.32.0 and 1.16.0)
• CVE-2026-44496 — unescaped XSRF cookie name used to build a regular expression (fixed in 0.32.0 and 1.16.0)

Note that CVE-2026-44495 was already resolved by the bump to 1.15.2 and is not in scope here.

axios published a further set of advisories on 2026-07-06 which may require a version later than 1.16.0; it would be worth checking https://github.com/axios/axios/security/advisories before selecting a target version.

The previous axios upgrade in this repository was #33590 (1.11.0 → 1.15.0, shipped in 15.14.0).