Executive brief
Axios is a widely used tool for making web requests in JavaScript applications. A vulnerability exists where Axios can be manipulated into sending unauthorized web headers or crashing entirely if another part of the application has already been compromised by a 'prototype pollution' attack. This could allow an attacker to disrupt service or interfere with how the application communicates with other web services.
Technical details
Axios contains two read-side prototype pollution gadgets in its configuration merging logic. The first gadget in 'lib/utils.js' uses a plain object accumulator during merges, allowing polluted properties from Object.prototype to be copied into outbound HTTP headers, potentially leading to header injection or response suppression. The second gadget in 'lib/core/mergeConfig.js' uses a plain-object literal as a property descriptor; if Object.prototype.get or .set is polluted with a non-function value, 'Object.defineProperty' throws a TypeError, causing a synchronous crash of every Axios request. These vulnerabilities require a pre-existing prototype pollution vulnerability in the environment (e.g., via an upstream dependency like lodash) to be exploitable. The issue is fixed in versions 0.32.0 and 1.16.0 by using null-prototype objects.
Affected products
- Axios Axios < 0.32.0, < 1.16.0
Timeline
- 2026-05-29: advisory: GitHub Security Advisory GHSA-898c-q2cr-xwhg published
- 2026-06-11: disclosed: CVE-2026-44490 published to NVD