Description
Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.0.0, < 1.20.0 >= 0.27.2, < 0.34.0** Patched version(s): **1.20.0 0.34.0**
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - CVE-2026-101905
- axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge - CVE-2026-44495
- axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` - CVE-2026-44494
- Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` - CVE-2026-42044
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026