Description
Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password, axios reads inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound `Authorization: Basic …
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.15.2, < 1.18.0
- Patched version(s): 1.18.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Prototype pollution auth subfields can inject Basic auth and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy - CVE-2026-42041
- Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion - CVE-2026-42042
You might also like:
See something that needs correcting? Let us knowUpdated August 07, 2026