Prototype Pollution Vulnerability in Axios: Risk of Unauthorized Basic Auth Injection
Summary
GHSA-xj6q-8x83-jv6g: Axios: Prototype pollution auth subfields can inject Basic auth. Affects axios versions >= 1.15.2, < 1.18.0. Fixed in 1.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library supports features like interceptors, automatic JSON data transformation, and request cancellation. However, it is vulnerable to a prototype pollution issue that can lead to unauthorized access through manipulated Basic authentication headers.
Vulnerability Detail
The vulnerability arises from Axios's handling of the 'auth' object in HTTP requests. When an application affected by prototype pollution passes an empty or partial 'auth' object to Axios, it inadvertently allows the library to read inherited properties from 'Object.prototype'. This can lead to the injection of attacker-controlled Basic authentication credentials into outbound requests. The exploitation requires a separate prototype pollution primitive in the host application, making it a significant security risk for applications that do not properly sanitize their inputs.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.18.0
This is the first release that contains the fix.
npm install axios@1.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing empty or partial 'auth' objects to Axios. Ensure that the 'auth' object contains valid 'username' and 'password' properties before making requests. For example:
const auth = { username: 'your-username', password: 'your-password' };
axios.get('http://example.com/api', { auth: auth });
Conclusion
The prototype pollution vulnerability in Axios poses a significant risk to applications that do not properly handle the 'auth' object in HTTP requests. By updating to the patched version and following the recommended workarounds, developers can mitigate the risk of unauthorized access through manipulated Basic authentication headers.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify an object's prototype, potentially leading to unauthorized access or manipulation of properties across all instances of that object.
If your application is affected by this vulnerability, an attacker could inject malicious Basic authentication credentials into outbound requests, leading to unauthorized access to sensitive resources.
Your application may be vulnerable if it uses a version of Axios prior to 1.18.0 and passes empty or partial 'auth' objects without proper validation.
If you cannot update Axios right away, implement the recommended workaround by ensuring that you do not pass empty or partial 'auth' objects in your requests.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
