Description
Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.
The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.0.0, < 1.18.0 >= 0.8.0, < 0.33.0** Patched version(s): **1.18.0 0.33.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Nested axios option objects can consume polluted prototype values and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype pollution gadgets can alter axios request construction - Vulnerability
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026