Executive brief
Axios, a widely-used HTTP client library for JavaScript, has a flaw in its cross-site request forgery (XSRF) token protection logic that can leak anti-CSRF tokens to attacker-controlled domains. When the `withXSRFToken` configuration property is set to any truthy non-boolean value (either through prototype pollution or misconfiguration), the library fails to perform its same-origin security check and sends XSRF tokens to all domains. An attacker can exploit this to steal XSRF tokens and use them to forge requests on behalf of victims visiting vulnerable applications.
Technical details
The vulnerability exists in `lib/helpers/resolveConfig.js` where the XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison. The vulnerable code evaluates `if (withXSRFToken || (withXSRFToken !== false && isURLSameOrigin(...)))`, which short-circuits when `withXSRFToken` is any truthy non-boolean value (e.g., 1, "false", {}, []), bypassing the `isURLSameOrigin()` check entirely. An attacker can trigger this via prototype pollution (polluting `Object.prototype.withXSRFToken` with a truthy value) or through developer misconfiguration (passing a string instead of a boolean). This causes Axios to leak XSRF cookie values as headers to all request targets, including cross-origin servers. The vulnerability is browser-only, affecting applications making cross-origin requests; however, the leaked XSRF token enables CSRF attacks against the victim application. Patches are available in Axios versions >=1.15.1 and >=0.31.1, which use strict boolean comparison.
Affected products
- Axios Axios <=1.15.0, <=0.31.0
Timeline
- 2026-04-24: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Patched in Axios >=1.15.1 and >=0.31.1