Axios: Prototype pollution gadgets can alter axios request construction
- Severity:
- Medium
Description
axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options() read inherited data before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **< 0.33.0 >= 1.0.0, < 1.18.0** Patched version(s): **0.33.0 1.18.0**
References
Related Issues
- Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking - CVE-2026-42264
- Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking - CVE-2026-42033
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
- Tags:
- npm
- axios
Anything's wrong? Let us know Last updated on July 20, 2026