Executive brief
Axios is a widely-used HTTP client library that makes requests from applications to APIs and web services. A prototype pollution vulnerability allows an attacker who can inject code or data elsewhere in the application's dependency chain to inject arbitrary HTTP headers into requests made by Axios—including authentication headers, user identity headers, and role information. An attacker could exploit this to impersonate users, bypass authentication, escalate privileges, or perform unauthorized actions on downstream services that trust these headers.
Technical details
The vulnerability exists in lib/adapters/http.js, where Axios uses duck-type checking to identify FormData payloads. When Object.prototype is polluted with specific properties (getHeaders, append, pipe, on, once, Symbol.toStringTag), Axios incorrectly identifies a plain object as a FormData instance and calls the attacker-controlled getHeaders() function, merging malicious headers into the outgoing request. The vulnerability requires a prototype pollution primitive somewhere in the application's dependency tree (e.g., via lodash.merge, qs, JSON5, or similar libraries), but the pollution source does not need to be Axios itself. The attack is triggered when the application makes HTTP requests with a data payload (POST, PUT, PATCH). Patches are available in versions 1.15.1 and 0.31.1; the recommended fix adds an explicit own-property check using hasOwnProperty to prevent prototype chain lookups.
Affected products
- Axios Axios <=1.15.0, <=0.31.0
Timeline
- 2026-04-24: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Versions 1.15.1 and 0.31.1