Axios: Prototype pollution gadgets can alter axios request construction

Description

axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options() read inherited data before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **< 0.33.0

  >= 1.0.0, < 1.18.0**

• Patched version(s): **0.33.0

  1.18.0**

References

• GHSA-mmx7-hfxf-jppx
• CWE-1321