Prototype Pollution Vulnerability in Axios Package: Nested Option Objects Exploitable
Summary
GHSA-9wx3-p993-35vp: Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values. Affects axios versions >= 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library is widely adopted due to its ease of use, promise-based architecture, and ability to handle requests and responses seamlessly. However, a vulnerability exists in certain versions of Axios that allows for prototype pollution through nested option objects, potentially leading to unauthorized access and data manipulation.
Vulnerability Detail
The vulnerability arises from the way Axios handles nested request option objects. In versions prior to 0.33.0 and 1.x before 1.18.0, Axios can consume inherited properties from these nested objects when the Object.prototype has been polluted. This means that if an application passes placeholder nested objects like auth: {} or paramsSerializer: {}, inherited properties such as username/password can be injected silently, leading to unauthorized Authorization headers. This vulnerability is particularly dangerous in environments where prototype pollution is already present, allowing attackers to manipulate query-string serialization and potentially execute malicious code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using nested option objects that could inherit properties from the prototype. Instead, explicitly define your options without relying on empty objects. For example, instead of using auth: {}, define your authentication parameters directly: auth: { username: 'yourUsername', password: 'yourPassword' }.
Conclusion
The prototype pollution vulnerability in Axios poses a significant risk to applications using affected versions. By updating to version 1.18.0 or later, developers can protect their applications from potential exploitation. Additionally, using tools like Vulert can help monitor for vulnerabilities in real-time, ensuring that your software remains secure.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unauthorized access or modification of properties in JavaScript applications.
Axios versions before 0.33.0 and 1.x before 1.18.0 are affected by this prototype pollution vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json, it can help you determine if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, such as credentials, and can allow attackers to manipulate application behavior through injected properties.
While the best solution is to update to a patched version, you can mitigate the issue by avoiding the use of nested option objects that may inherit properties from the prototype.
Related vulnerabilities
Recent vulnerabilities recorded for axios.
