Find, fix and prevent vulnerabilities in your code.

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the isLoopback() and isIPv4Loopback() functions of lib/helpers/shouldBypassProxy.js, which require the first IPv4 octet to be 127 and therefore do not recognize 0.0.0.0 as a loopback address. An attacker who controls the request URL or a redirect target can bypass the NO_PROXY policy for local addresses and route requests to http://0.0.0.0:<port>/ through the configured proxy, reaching internal services, cloud IMDS endpoints, or microservice APIs. Exploitation requires the Node HTTP adapter with HTTP_PROXY or HTTPS_PROXY set and NO_PROXY listing local addresses, attacker control over the URL or redirect target, and a proxy able to reach the local destinations.

Workaround

This vulnerability can be avoided by explicitly adding 0.0.0.0 to the NO_PROXY list, so requests to it are excluded from the proxy as the loopback check intended.

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the Node HTTP adapter (lib/adapters/http.js), which reads config.proxy through the prototype chain after a request interceptor returns a plain-object clone that lib/core/dispatchRequest.js dispatches without re-applying the null-prototype hardening. An attacker who can pollute Object.prototype.proxy can route a victim's outbound plaintext HTTP requests through an attacker-controlled proxy, disclosing Authorization headers, Basic credentials, request metadata, and POST bodies and enabling forged responses, when the application uses an interceptor that returns a spread or Object.assign copy of the config. Exploitation requires the Node HTTP adapter, a separately polluted Object.prototype.proxy, a request interceptor that returns a plain-object copy of the config, and no own proxy value on the request, and HTTPS under normal TLS validation does not disclose the headers or body.

Workaround

This vulnerability can be avoided by setting proxy: false on the affected requests or the axios instance, which supplies an own proxy value that shadows the polluted prototype property.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42264.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify() on a value when its top-level key ends in {}, before the maxDepth guard can inspect the nested structure. An attacker can crash the process by supplying an object with a top-level key ending in {} and thousands of levels of nesting, which native JSON.stringify() recurses through until the call stack overflows with a RangeError. Exploitation requires the application to pass untrusted input through axios as data or params, with a top-level key ending in {} and nesting beyond roughly 2500 to 3000 levels.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42039.

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the buildPath() function of lib/helpers/formDataToJSON.js, which recurses over bracket-delimited FormData key segments without a depth limit. An attacker can crash the Node.js process by supplying a FormData field name with tens of thousands of nested bracket segments, such as a[x][x][x]..., which exhausts the JavaScript call stack with a RangeError. Exploitation requires the application to pass attacker-controlled FormData into formDataToJSON, either by calling axios.formToJSON() on it or by sending it through axios with a JSON content type.

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on streamed uploads because the byte-counting wrapper is gated on config.maxBodyLength > -1 && config.maxRedirects === 0 and the HTTP/2 path bypasses follow-redirects with default redirect settings. An attacker who controls the upload stream can force the application to transmit arbitrarily large outbound payloads, exhausting egress, upstream quota, or connection and memory budgets, by feeding stream contents into an HTTP/2 request with a finite maxBodyLength that the limit check never inspects. Exploitation requires the Node HTTP adapter with httpVersion: 2, request data supplied as a stream, and a finite maxBodyLength, while HTTP/1.1 requests through follow-redirects, buffered String/Buffer/ArrayBuffer bodies, and the default unlimited maxBodyLength: -1 are unaffected.

Workaround

This vulnerability can be avoided on axios 1.15.1 and later by setting maxRedirects: 0 on the affected HTTP/2 streamed upload calls, which activates the existing byte-counting wrapper so oversized streams are rejected.

Remediation

Upgrade axios to version 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the getBodyLength() and resolveBodyLength() functions of lib/adapters/fetch.js, which lack a branch for WHATWG ReadableStream bodies, so the resolved length is undefined and the pre-dispatch maxBodyLength check is skipped. An attacker who controls a streamed request body can transmit uploads that exceed the configured maxBodyLength, causing unexpected outbound egress and consuming upstream API quota or bandwidth, by supplying a ReadableStream without a reliable Content-Length to a fetch-adapter request. Exploitation requires the fetch adapter, a body-bearing method such as POST, PUT, or PATCH, request data supplied as a ReadableStream without a reliable Content-Length, and a finite maxBodyLength, while the Node HTTP adapter and known-length bodies are unaffected.

Workaround

This vulnerability can be avoided in Node.js by using the HTTP adapter (adapter: "http") for untrusted stream uploads, which enforces the stream body limit that the fetch adapter does not.

Remediation

Upgrade axios to version 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the Basic authentication header construction in lib/adapters/http.js and lib/helpers/resolveConfig.js, which read the username and password from the auth object without own-property checks, so the reads traverse the prototype chain. An attacker who can pollute Object.prototype.username or Object.prototype.password can inject or override the Basic auth header on axios requests that pass an empty or partial own auth object, enabling credential exfiltration or outbound request tampering. Exploitation requires a separate prototype pollution primitive already present in the host process and an axios call pattern that supplies an empty or partial auth object, such as auth: opts.auth || {}.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42264.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution n the getMergedValue() function of lib/core/mergeConfig.js, which clones nested option objects such as auth and paramsSerializer into plain {} containers that inherit from Object.prototype, so downstream reads in lib/helpers/resolveConfig.js, lib/adapters/http.js, and lib/helpers/buildURL.js pick up polluted values without own-property checks. An attacker who can pollute Object.prototype can inject an Authorization: Basic header or fully override query-string serialization through paramsSerializer.serialize, enabling request tampering, cache poisoning, or signature-check bypass, on axios calls that pass placeholder nested objects like auth: {} or paramsSerializer: {}. Exploitation requires a separate component to have already polluted Object.prototype and the application to pass empty or partial nested option objects.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the bodyless method aliases in lib/core/Axios.js, the proxy handling in lib/adapters/http.js, and the paramsSerializer read in lib/helpers/resolveConfig.js, which read data, proxy, and paramsSerializer off the config without own-property checks, so polluted Object.prototype values are picked up. An attacker who can pollute Object.prototype can attach body data to a bodyless request such as axios.get(), route requests through an attacker-controlled proxy, or execute an attacker-supplied paramsSerializer during URL serialization, by setting Object.prototype.data, Object.prototype.proxy, or Object.prototype.paramsSerializer. Exploitation requires a separate component to have already polluted Object.prototype, commonly through a transitive dependency.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-42264.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

• Unsafe Object recursive merge

• Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

• Application server

• Web server

• Web browser

How to prevent

1. Freeze the prototype— use Object.freeze (Object.prototype).

2. Require schema validation of JSON input.

3. Avoid using unsafe recursive merge functions.

4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release

Overview

axios is a promise-based HTTP client for the browser and Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the buildPath() function of lib/helpers/formDataToJSON.js, which recurses once per FormData key path segment without enforcing a maximum depth. An attacker can crash the process by supplying a FormData field name with thousands of nested bracket segments, such as a[x][x][x]..., which drives formDataToJSON() into recursion that exhausts the JavaScript call stack with a RangeError. Exploitation requires the application to process untrusted FormData through formToJSON() or by sending it with a JSON content type.

Remediation

Upgrade axios to version 0.33.0, 1.18.0 or higher.

References

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release