Description
Axios request interceptors may return a replacement config object. If an interceptor returns a plain object without an own headers property, dispatchRequest() later evaluates config.headers and can resolve an inherited Object.prototype.headers value. In a process where another vulnerability has polluted Object.prototype.headers, axios can send attacker-controlled headers.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Header Injection via Inherited headers After Minimal Interceptor and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders - CVE-2026-101900
- Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - CVE-2026-40175
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - CVE-2026-67320
- Axios: Header Injection via Prototype Pollution - CVE-2026-42035
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026