Executive brief
Axios is an HTTP client library widely used in JavaScript applications for making web requests. This vulnerability allows attackers to steal authentication credentials (usernames, passwords) and modify HTTP responses if another library in the application has already polluted JavaScript's Object.prototype. Exploitation requires a separate prototype pollution vulnerability elsewhere in the dependency tree, but once that occurs, axios requests automatically expose sensitive auth data and can be hijacked.
Technical details
This vulnerability exists in axios's mergeConfig() and transformData() functions. The mergeConfig() function reads config properties via standard JavaScript property access (e.g., config[key]), which traverses the prototype chain. When Object.prototype.transformResponse is polluted with a function by a separate prototype-pollution vulnerability elsewhere in the application, the mergeConfig() path can inherit that function instead of using Axios's default JSON response parser. The polluted function is later executed during response transformation with this=config, exposing sensitive properties including auth.username, auth.password, request URL, and headers. Some later v1 releases added guards in the merge path but still used inherited properties during config validation via validator.assertOptions(), allowing a polluted function to inspect config during validation. Fixed versions use own-property checks (hasOwnProperty guards) and null-prototype config objects to prevent prototype chain traversal. No direct user input or interaction is required; exploitation is automatic once Object.prototype is polluted by a helper vulnerability.
Affected products
- axios axios >=0.19.0, >=1.0.0
Timeline
- 2026-05-29: disclosed: Vulnerability published as GHSA-3g43-6gmg-66jw and CVE-2026-44495
- 2026: patched: Fixed in axios >=1.15.2 and >=0.31.1