Axios, a widely used HTTP client for browsers and Node.js, processes objects through its toFormData helper. Between versions 0.28.0 and 0.34.0 and 1.15.1 and 1.20.0 the helper unintentionally inherited serialization options and visitor properties from a polluted prototype. This allowed an attacker to alter field naming, change how data is interpreted, force request failures by overriding maxDepth, modify Blob handling, and, if the attacker already possessed a function‑injection primitive, trigger execution of a function during serialization. The result is that crafted data can corrupt request payloads or, in the presence of additional exploitation capabilities, execute code within the same process.

The axios:axios package is affected. Releases from 0.28.0 through 0.34.0 and from 1.15.1 through 1.20.0 contain the flaw. The issue was fixed in v0.34.0 and v1.20.0, so any newer release is not vulnerable.

The CVSS score of 8.3 classifies this vulnerability as High severity. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or same‑process: an attacker who can influence the JavaScript environment that invokes axios.toFormData can set prototype properties. Under those conditions the attacker can corrupt the request payload or, if additional code‑execution primitives exist, run malicious code in the same process. In environments where Axios runs with elevated privileges or handles sensitive data, the risk is greater; otherwise the threat remains limited to data integrity and request reliability.