Axios: Nested axios option objects can consume polluted prototype values

Description

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.

The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.0.0, < 1.18.0

  >= 0.8.0, < 0.33.0**

• Patched version(s): **1.18.0

  0.33.0**

References

• GHSA-7q8q-rj6j-mhjq
• CWE-1321

Related Issues

• Axios: Prototype pollution gadgets can alter axios request construction - Vulnerability
• devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
• Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
• Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - Vulnerability

You might also like:

5 Security Vulnerabilities You Can Fix Right Now

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

axios