Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the vulnerability and the provided patch (commit afca61a) clearly points to the setProxy function in lib/adapters/http.js as the source of the credential leak. The vulnerability description explicitly mentions that setProxy adds the Proxy-Authorization header but fails to clear it during certain redirect scenarios. The patch directly modifies this function, changing its signature to setProxy(options, configProxy, location, isRedirect) and adding a code block that conditionally removes the Proxy-Authorization header if isRedirect is true. This confirms that the logic within setProxy was flawed and is the root cause of the vulnerability. During exploitation, this function would be invoked as part of the redirect handling, and its failure to remove the stale header would lead to the credential leak. Therefore, setProxy is the precise vulnerable function.
setProxylib/adapters/http.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| axios | npm | >= 1.0.0, < 1.16.0 | 1.16.0 |
| axios | npm | <= 0.31.1 | 0.32.0 |