Executive brief
Axios, a popular HTTP client library for JavaScript, fails to sanitize nested configuration objects (like auth and paramsSerializer) against prototype pollution attacks. If another part of an application has already polluted the global Object.prototype, an attacker can inject malicious values that cause axios to silently add unauthorized HTTP headers or modify query strings in outbound requests.
Technical details
The vulnerability is a prototype pollution gadget in axios's configuration merging logic (CWE-1321). The root cause is in lib/core/mergeConfig.js, which hardened the top-level config object with Object.create(null) but still clones nested objects using ordinary {} constructors, causing them to inherit from Object.prototype. Downstream code in lib/helpers/resolveConfig.js, lib/adapters/http.js, and lib/helpers/buildURL.js reads auth.username, auth.password, paramsSerializer.encode, and paramsSerializer.serialize without own-property checks. An attacker must first have a prototype pollution primitive in the application (from another vulnerable component), then pass empty nested objects like auth: {} or paramsSerializer: {} to axios methods. This causes inherited malicious values to be silently injected: Basic auth headers (string pollution), query-string serialization changes (function pollution), or request failures. The attack requires network reachability to axios and pre-existing prototype pollution elsewhere in the process; no user interaction or privileges are required. Patches are available in axios >=0.33.0 and >=1.18.0.
Affected products
- axios axios >=0.8.0, <0.33.0
- axios axios >=1.0.0, <1.18.0
Timeline
- 2026-07-06: disclosed: Security advisory GHSA-7q8q-rj6j-mhjq published by axios
- 2026-08-01: advisory: Duplicate advisory GHSA-9wx3-p993-35vp published to GitHub Advisory Database
- 2026-08-01: patched: Patches available in axios >=0.33.0 and >=1.18.0
- 2026-09-01: other: GHSA-9wx3-p993-35vp withdrawn as duplicate; refer to GHSA-7q8q-rj6j-mhjq