Axios, a promise based HTTP client for the browser and Node.js, contains read‑side prototype‑pollution gadgets in its merge functions prior to versions 0.32.0 and 1.16.0. When an upstream dependency such as lodash performs _.merge and pollutes Object.prototype, Axios silently absorbs the polluted values. The first gadget copies polluted bucket keys into merged headers, resulting in header injection that can leak data or alter request semantics. The second gadget creates a descriptor that, when polluted, triggers a synchronous TypeError on every request, leading to a denial of service. This flaw allows an attacker who can influence the environment of a running process to disrupt or tamper with HTTP traffic.

The vulnerability affects the Axios library under the axios:axios product. All versions of axios older than 0.32.0 in the 0.x series and older than 1.16.0 in the 1.x series are impacted. No specific operating systems or runtime environments are mentioned, but the flaw is present in both browser and Node.js usage.

The CVSS score is 4.8, indicating a moderate impact level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers can exploit the issue by ensuring that a vulnerable dependency such as lodash is used in the same process, thereby polluting Object.prototype. This does not require network access or user interaction beyond the application’s runtime environment, but the attack vector is primarily via a compromised process or malicious library injection.