The issue arises from prototype pollution in the Axios HTTP client. In versions 1.15.2 through 1.15.x, the utils.merge() function creates nested configuration objects that inherit from Object.prototype. The setProxy() routine (lib/adapters/http.js) then reads proxy.username, proxy.password and proxy.auth without checking hasOwnProperty. If an attacker has injected a property such as username onto Object.prototype, the routine will build a Proxy‑Authorization header using that polluted value and attach it to every proxied request. The headers thus contain attacker‑controlled credentials, leading to credential disclosure and potential authentication abuse. The flaw does not cause arbitrary code execution but represents a header injection and unsanitised input weakness (CWE‑113, CWE‑1321, CWE‑346).

Axios HTTP client for both browser and Node.js versions 1.15.2 up to, but not including, 1.16.0 are affected. The flaw exists in the utils.merge() and setProxy() logic of adapters/http.js. Upgrading to 1.16.0 or later removes the vulnerability.

The flaw carries a CVSS score of 3.7, indicating low to moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker able to execute JavaScript in the same runtime as the Axios instance – for example, via a cross‑site scripting or remote code execution vulnerability in the application. Once the prototype is polluted, every HTTP request that uses Axios as a proxy will silently emit attacker‑controlled credentials, which could be used to authenticate to third‑party services or implicate legitimate user accounts.