Executive brief
Axios, a popular JavaScript HTTP client library, can be exploited to inject malicious headers or alter request parameters when an application's JavaScript environment has already been compromised by prototype pollution from another dependency. If an application passes empty nested configuration objects (like auth: {} or paramsSerializer: {}), Axios will inherit malicious values from the polluted prototype, allowing an attacker to silently add authentication headers or tamper with query strings. This requires a pre-existing prototype pollution vulnerability elsewhere in the application but creates a dangerous secondary gadget chain.
Technical details
This vulnerability is a prototype pollution gadget chain in Axios that allows consumption of polluted Object.prototype properties through nested request option objects. The root cause lies in lib/core/mergeConfig.js and downstream code: while top-level config uses Object.create(null) for protection, nested objects (auth, paramsSerializer) are cloned as ordinary {} objects and read without own-property checks. An attacker with a pre-existing prototype pollution primitive can define inherited username, password, encode, and serialize properties. When application code passes placeholder nested objects (auth: {}, paramsSerializer: {}), these inherited values are silently used, enabling silent Authorization header injection (for auth) or query-string tampering (for paramsSerializer). Attack requires: (1) another component has already polluted Object.prototype, (2) application passes an affected nested option object, and (3) no explicit own properties override the inheritance. Fixed in Axios 0.33.0 and 1.18.0.
Affected products
- Axios Axios >=0.8.0, <0.33.0; >=1.0.0, <1.18.0
Timeline
- 2026-07-06: disclosed
- 2026-07-06: patched: Patched in Axios 0.33.0 and 1.18.0