Description
Axios’ Node HTTP adapter can act as a read-side prototype-pollution gadget for Node’s sensitive createConnection request option. The adapter creates a null-prototype options object, but Node’s HTTP client can copy or normalize request options into ordinary objects before connection creation. If Object.prototype.createConnection has been polluted elsewhere in the same process, Node can call the inherited function and create a socket to an attacker-controlled endpoint.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.15.2, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth - CVE-2026-101902
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` - CVE-2026-44494
- Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning - CVE-2026-67320
