Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Description

Axios’ Node.js HTTP adapter can route requests through an attacker-controlled proxy when Object.prototype.proxy is polluted and request configuration is materialized as a regular object before dispatch.

Recent axios releases harden merged request config by creating a null-prototype object.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 1.15.2, < 1.18.0

  >= 0.31.1, < 0.33.0**

• Patched version(s): **1.18.0

  0.33.0**

References

• GHSA-gcfj-64vw-6mp9
• CWE-1321
• CWE-200
• OWASP 2021-A1

Related Issues

• Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter - CVE-2026-44487
• Axios HTTP/2 Session Cleanup State Corruption Vulnerability - CVE-2026-39865
• Axios: Nested axios option objects can consume polluted prototype values - Vulnerability
• Axios: HTTP/2 streamed uploads bypass `maxBodyLength` - Vulnerability

You might also like:

Why you should use passive vulnerability scan on your website

How to Use SmartScanner for Securing Your Node.js Applications

5 Security Vulnerabilities You Can Fix Right Now

Tags:

npm

axios