axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

Description

axios 1.15.2 exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values:

1. Header injection - lib/utils.js line 406 builds merge()’s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket’s own keys are copied into the merged headers and ride out on the wire. 2.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 0.31.1

  >= 1.0.0, < 1.16.0**

• Patched version(s): **0.32.0

  1.16.0**

References

• GHSA-898c-q2cr-xwhg
• CVE-2026-44490
• CWE-1321
• CAPEC-310
• OWASP 2021-A6