PT-2026-67296 · Npm · Axios
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
axios versions prior to 0.33.0
axios versions prior to 1.18.0
Description
axios is susceptible to read-side prototype pollution gadgets that can alter request construction if
Object.prototype has been polluted by another vulnerability or dependency. In bodyless method aliases such as axios.get(), axios.delete(), axios.head(), and axios.options(), the software reads inherited data via (config || {}).data before config normalization. This allows an attacker to inject a controlled request body into requests that were not intended to have one, potentially corrupting request semantics on the receiving service.Additionally, low-level paths are affected when exported adapters or helpers (such as
lib/adapters/http.js and unsafe/helpers/resolveConfig.js) are called directly with plain configurations. In these instances, the software may inherit polluted proxy values, routing requests through an attacker-controlled proxy, or polluted paramsSerializer values, allowing attacker-controlled URL serialization. These low-level issues do not occur during normal high-level axios calls in versions 1.15.2 and later.Recommendations
Update axios to version 0.33.0 or later.
Update axios to version 1.18.0 or later.
As a temporary mitigation, explicitly pass
data: undefined when using bodyless method aliases in environments where prototype pollution is a concern.
Avoid processing untrusted input with libraries or code paths capable of polluting Object.prototype.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Axios