Axios, a promise‑based HTTP client, contains a prototype pollution vulnerability that allows an attacker to silently alter every JSON response received by the application and to hijack the underlying HTTP transport, exposing request credentials, headers, and body. The flaw arises when Object.prototype is polluted by any co‑dependency or other code in the same process that adds keys read by Axios without guarding against prototype properties. This can lead to unauthorized data manipulation, credential theft, and potential further compromise of application logic.

Axios versions prior to 1.15.1 and 0.31.1 used in both browser and Node.js environments are affected. The vulnerability is present in any deployment that includes an earlier Axios release in the same process as a package capable of polluting Object.prototype.

The CVSS score of 7.4 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Axios is not listed in CISA's KEV catalog. Exploitation requires a separate component that can pollute the prototype in the same process, so a web application using Axios in conjunction with a vulnerable dependency that modifies Object.prototype would be the likely attack surface. Once the prototype is polluted, the attacker can hijack HTTP requests and perform response tampering or data exfiltration. The attack vector and exploitation prerequisites are inferred from the description and not explicitly stated in the advisory.