Prototype Pollution Vulnerability in Axios: Risk of Malicious Request Manipulation
Summary
GHSA-mmx7-hfxf-jppx: Axios: Prototype pollution gadgets can alter axios request construction. Affects axios across 2 version ranges.
< 0.33.0
>= 1.0.0, < 1.18.0
Fixed in 0.33.0 or 1.18.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js. It simplifies the process of sending asynchronous requests and handling responses, making it a go-to choice for developers. However, a vulnerability has been identified that allows prototype pollution, which can lead to unauthorized manipulation of request data.
Vulnerability Detail
The vulnerability in Axios arises from its handling of request configurations, specifically when Object.prototype has been polluted by another vulnerability. This allows an attacker to manipulate request bodies in methods like axios.get(), axios.delete(), axios.head(), and axios.options(). If an attacker can control the prototype, they can inject malicious data into requests that do not explicitly set a body, potentially corrupting request semantics. Additionally, low-level usage paths can expose sensitive information through proxy routing or URL serialization, depending on the configuration inherited from the polluted prototype.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.33.00.33.0npm install axios@0.33.0 -
>= 1.0.0, < 1.18.01.18.0npm install axios@1.18.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can explicitly pass data: undefined in your requests using bodyless method aliases to mitigate the risk of prototype pollution. For example:
axios.get('http://example.com/api', { data: undefined });
Conclusion
The prototype pollution vulnerability in Axios poses a significant risk to applications that rely on this library for HTTP requests. By updating to the patched version or implementing the suggested workaround, developers can mitigate the risks associated with this vulnerability and ensure the integrity of their applications.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of a base object, potentially leading to unauthorized access or modification of properties.
If your application uses Axios and is vulnerable, an attacker could inject malicious data into HTTP requests, leading to unexpected behavior or data exposure.
Axios versions prior to 1.18.0 and 0.33.0 are affected by this vulnerability.
Yes, you can use Vulert to monitor your application for vulnerabilities. By analyzing your package-lock.json file, Vulert can alert you to any open-source vulnerabilities in real-time.
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
