Axios, a widely used HTTP client, contains an object prototype pollution flaw that lets an attacker overwrite Object.prototype.validateStatus with a function that always returns true. This causes Axios to treat every HTTP status code as a successful response, silently bypassing error handling and application‑level authentication. The result is that protected resources may be accessed without proper credential verification while the attacker remains invisible to normal error‑logging or monitoring pipelines. The weakness involves improper handling of prototype chains (CWE-1321), inadequate authentication checks (CWE-287), and exploitation through property mutation that escalates privileges (CWE-915).

Vulnerable versions of the Axios library are those older than 1.15.1 for Node.js and older than 0.31.1 for browser environments. Any project that imports or requires those legacy packages is at risk, regardless of the surrounding infrastructure.

The CVSS score of 4.8 indicates moderate severity; the EPSS score of less than 1% shows that exploitation is unlikely to be prolific, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves executing arbitrary JavaScript in an environment that imports Axios, so it is most relevant to web applications, server‑side scripting, or any environment where client code can influence server requests. If the attacker can manipulate Object.prototype—common in environments that serve or process untrusted input—then the prototype‑pollution gadget will be triggered, flattening error codes and enabling unauthorized access.