Executive brief
Axios, a popular HTTP client library used in millions of Node.js and browser applications, can be exploited when the JavaScript runtime has a polluted Object.prototype. An attacker who can pollute the prototype chain can inject malicious credentials into requests (e.g., fake Authorization headers) or tamper with query parameters. This vulnerability requires a prior prototype-pollution bug elsewhere in the application stack to be exploitable.
Technical details
This vulnerability is a prototype-pollution gadget in Axios that affects nested request option objects (auth, paramsSerializer). While the top-level merged config is protected with Object.create(null), nested objects are cloned into ordinary objects using plain {} constructors, allowing inherited properties from a polluted Object.prototype to be read. An attacker who has already polluted Object.prototype (via a separate vulnerability elsewhere in the application) can inject or override username/password for Basic auth or inject serialize/encode functions for query-string tampering. The attack requires passing placeholder nested objects like auth: {} or paramsSerializer: {} without explicit own properties. Patched versions (0.33.0+, 1.18.0+) harden these nested objects.
Affected products
- Axios Axios >=0.8.0 <0.33.0, >=1.0.0 <1.18.0
Timeline
- 2026-07-20: disclosed
- 2026-07-06: patched: Patches released: 0.33.0, 1.18.0