Description
Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.15.1, < 1.20.0 >= 0.28.0, < 0.34.0** Patched version(s): **1.20.0 0.34.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Prototype Pollution Gadget in axios toFormData Options and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - CVE-2026-101905
- Axios: Prototype pollution gadget in fetch adapter can alter outbound requests - CVE-2026-101908
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026