Axios resolves FormData headers by reading inherited properties. An attacker can create an object that inherits a getHeaders method returning attacker‑controlled headers, which axios merges into the fetch adapter request. This lets the attacker alter authorization headers, cache directives, metadata‑service endpoints, or any other request metadata, potentially bypassing authentication or modifying API calls.

The vulnerability affects the axios HTTP client for both browser and Node.js versions from 1.12.0 up to 1.20.0. The affected product is identified as axios:axios and the fix is available in version 1.20.0 and later.

The CVSS score of 6.9 classifies this flaw as moderate. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a local attacker with access to the JavaScript runtime to inject a prototype‑polluted object that axios interprets as FormData. Based on the description, it is inferred that the attack vector involves prototype‑pollution through inheritance of getHeaders, making exploitation unlikely in distant environments but capable of altering request behavior if an attacker controls the JavaScript context.