Axios allows a prototype‑pollution flaw that places a function on Object.prototype.createConnection. Node.js then resolves and invokes this inherited function as its socket factory for HTTP requests. The attacker can inject a custom function that selects an arbitrary transport endpoint, thereby receiving full request headers and bodies—including credentials—and returning attacker‑controlled responses while the target URL appears legitimate. This vulnerability is a form of request socket hijacking that can lead to credential theft and tampering of HTTP traffic.

Axios versions 1.15.2 through 1.19.x are affected. The issue was resolved with the release of Axios 1.20.0. Existing deployments using any prior 1.x release without the fix are vulnerable.

The CVSS score of 7.6 indicates moderate to high severity. The EPSS score is <1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires prototype pollution within the same process that uses Axios, meaning an attacker must have a way to execute code or influence the environment of that process. If the application accepts untrusted input that could modify Object.prototype, the risk increases substantially. While no known public exploits exist, the potential to siphon credentials or inject malicious responses warrants prompt action.