Axios is a widely used HTTP client for browsers and Node.js. A prototype pollution flaw in the HTTP adapter can cause Axios to treat certain plain object payloads as FormData. When the polluted prototype contains getHeaders, append, pipe, on, once, and Symbol.toStringTag properties, the client invokes the attacker-controlled getHeaders() method and merges the returned headers into every outgoing request. This allows an attacker to insert arbitrary HTTP headers into requests that the application or a downstream server sends, potentially hijacking requests, redirecting traffic, or injecting malicious data.

The vulnerability affects the Axios package, versions prior to 1.15.1 for browsers and 0.31.1 for Node.js environments. Any application that imports these affected versions and has a dependency that can pollute Object.prototype will be susceptible.

The CVSS score of 7.4 indicates moderate to high severity, yet the EPSS score of less than 1% suggests that exploitation is presently unlikely. The weakness is not listed in CISA’s KEV catalog, meaning the vulnerability has not yet been demonstrated in widespread attacks. Attackers would need to induce prototype pollution in their own application's dependency tree, then trigger the gadget within Axios to inject headers into outgoing traffic. Given the dependency-specific nature of prototype pollution, exploitation remains relatively complex and likely requires local or privilege escalation within the attacked environment.