Axios, versions 1.0.0 through 1.15.x, improperly merges HTTP configuration settings. The config.proxy property is read without own‑property checks, allowing attackers to pollute Object.prototype and inject a proxy address. Once set, every Axios request is transparently routed through the attacker’s proxy, enabling interception, replay, or tampering of all HTTP traffic, including credentials.

The vulnerability affects projects that depend on the Axios library, specifically axios:axios versions 1.0.0 up to, but not including, 1.16.0. Any application that uses these Axios releases is potentially exposed if a dependency can perform prototype pollution.

The CVSS score of 8.7 indicates a high severity. No EPSS value is available, and the vulnerability is currently not listed in the CISA KEV catalog. Attackers can exploit it by first introducing prototype pollution through a vulnerable dependency in the application’s dependency tree and then using the polluted proxy setting to perform a full MITM attack. The risk is high due to the ability to exfiltrate confidential data and modify traffic without detection.