axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Description

axios 1.15.2 exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values:

1. Header injection - lib/utils.js line 406 builds merge()’s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket’s own keys are copied into the merged headers and ride out on the wire. 2.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 0.31.1

  >= 1.0.0, < 1.16.0**

• Patched version(s): **0.32.0

  1.16.0**

References

• GHSA-898c-q2cr-xwhg
• CVE-2026-44490
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• Axios: Header Injection via Prototype Pollution - CVE-2026-42035
• Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Host Header Injection and Python Tests with SmartScanner 1.11

How do hackers hack websites?

Tags:

npm

axios