Axios versions 1.0.0 through 1.20.0 are vulnerable to header injection caused by prototype pollution and interceptor handling. An attacker can set Object.prototype.headers in a running process and craft interceptors that produce requests without explicit header objects. When dispatchRequest normalizes the request configuration, inherited headers are merged, allowing attacker‑controlled headers—including Authorization—to reach the network layer. This can enable credential theft, session hijacking, or unauthorized API calls. The flaw is an injection vulnerability stemming from improper validation of request headers (CWE‑74, CWE‑1321, CWE‑915).

Axios (axios) 1.0.0‑1.20.0 is affected. The vulnerability exists in the dispatchRequest function used by all Axios clients that employ request interceptors and rely on the default prototype chain for headers.

The CVSS score of 6.9 classifies the vulnerability as medium severity. EPSS score of 0.00428 (<1%) indicates a very low likelihood of exploitation, and the issue is not present in the CISA KEV catalog. An exploit requires the ability to execute JavaScript in the same process that runs Axios, which is generally limited to trusted or compromised code paths. If an attacker can tamper with Object.prototype.headers or inject malicious interceptors, they can inject arbitrary request headers, potentially overriding authentication credentials.