PT-2026-67300 · Npm · Axios
CVSS v4.0
8.3
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
axios versions 0.31.1 through 0.32.x
axios versions 1.15.2 through 1.17.x
Description
In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy. While the software initially creates a null-prototype object for request configuration to prevent prototype pollution, request interceptors that use immutable patterns—such as
{...config} or Object.assign({}, config)—convert this back into a regular object. Because the software does not re-harden the configuration before dispatch, the Node HTTP adapter reads the config.proxy variable through the prototype chain. If an attacker pollutes Object.prototype.proxy, they can intercept plaintext HTTP requests to observe Authorization headers, Basic auth from config.auth, the request method, absolute URL, Host header, and the request body, and can also return custom responses. This issue does not affect browser adapters or HTTPS requests under normal TLS validation.Recommendations
Update axios to version 0.33.0 or later for the 0.x branch.
Update axios to version 1.18.0 or later for the 1.x branch.
As a temporary workaround, set
proxy: false on affected requests or axios instances when proxy support is not required.
Avoid using request interceptors that return regular object clones of the configuration.
Use the Node fetch adapter for affected requests where compatible with the application.Exploit
Fix
Information Disclosure
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Axios