Technical impact
This vulnerability in Axios allows an attacker to override the default HTTP method of requests that omit an explicit method by exploiting Object.prototype.method pollution. When a previous flaw injects or modifies the inherited "method" property on Object.prototype, subsequent calls such as axios.request({ url }) and axios({ url }) will send the polluted method instead of the intended GET. This can cause unintended state changes on the target server, representing a significant risk to integrity and potentially confidentiality, as documented under CWE‑1321.
Affected Systems
Axios 0.27.2 through 0.34.0 and 1.20.0, used in both browser and Node.js environments, were affected. The issue was discovered in the default instance of the Axios client, which does not guard against inherited prototype properties on request dispatch.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate to high severity. The EPSS score of < 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker to first pollute Object.prototype in the same process, then trigger an Axios request without a specified method. If this sequence is achieved, the attacker can force any HTTP method – including unsafe ones such as PUT, DELETE, or PATCH – thereby enabling unauthorized state‑changing operations.
Github GHSA