PT-2026-67299 · Npm · Axios
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
axios versions prior to 0.33.0
axios versions 1.x prior to 1.18.0
Description
Axios can consume inherited properties from nested request option objects when the JavaScript process's
Object.prototype has been polluted by another component. While the top-level merged configuration uses a null prototype for protection, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. If an application passes placeholder nested objects (e.g., auth: {} or paramsSerializer: {}), inherited values can be silently injected into outbound requests.Technical details include:
- Silent injection of an
Authorization: Basicheader via inheritedusernameandpasswordvariables. - Alteration of query-string serialization via inherited
encodeandserializevariables. Full replacement of the query string requires a function-valued pollution primitive.
This issue is exploitable only if prototype pollution already exists within the environment. Affected functionality includes Node HTTP adapter Basic auth handling in
lib/adapters/http.js, Browser/fetch/XHR Basic auth handling through lib/helpers/resolveConfig.js, and query serialization through lib/helpers/buildURL.js and axios.getUri().Recommendations
Update axios to version 0.33.0 or later.
Update axios to version 1.18.0 or later.
As a temporary workaround, avoid passing placeholder nested option objects; remove the
auth property entirely when Basic auth is not intended, and provide explicit own encode and serialize properties for paramsSerializer objects or remove the paramsSerializer when custom serialization is not required.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Axios