Technical impact
A prototype‑pollution flaw in axios versions 1.15.2 through 1.17.x enables an attacker who can set properties on Object.prototype with the names username or password to be reflected in outbound Basic auth headers. The vulnerability is triggered when an axios request supplies an auth object that omits those properties; axios reads the inherited prototype values and constructs the Authorization header from them. The flaw is a Prototype Pollution (CWE‑1321) that results in tampering of HTTP requests sent by the vulnerable application, potentially allowing credential injection or unauthorized impersonation, and in some situations could lead to credential disclosure if additional application‑specific conditions are met.
Affected Systems
Axios 1.15.2 up to, but not including, 1.18.0 is affected. The vulnerability exists in the lib/adapters/http.js and lib/helpers/resolveConfig.js modules. An affected system therefore comprises any Node.js application that uses axios 1.15.2–1.17.x, has the ability to set Object.prototype.username or Object.prototype.password, and performs authenticated HTTP requests without explicitly providing a username or password.
Risk and Exploitability
The CVSS score of 6.3 denotes a moderate severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Exploitation requires that the attacker first manages a separate prototype‑pollution primitive within the same process to set the legacy prototype properties. Once in place, any axios call lacking explicit auth credentials will automatically use the polluted values, leading to tampered Authorization headers. Because the flaw affects outbound traffic only, the primary impact is to compromise communication with downstream services rather than achieving direct code execution on the host.
Github GHSA