Axios versions before 0.33.0 (and Axios 1.x before 1.18.0) merge nested request options without own-property checks. When Object.prototype has been polluted by another component, inherited properties such as username, password, or custom serialization functions are read as real values. This can silently insert a Basic Authorization header or alter query‑string serialization, allowing an attacker who has already polluted the prototype to inject unauthorized credentials or change request semantics. The flaw is a prototype‑pollution weakness (CWE‑1321) and an inadequate handling of nested objects that enables serialization manipulation (CWE‑915).

Any Node.js application that imports an Axios release older than 0.33.0 or 1.x older than 1.18.0 is affected. The issue is triggered through the Axios HTTP client in environments where other dependencies have previously polluted Object.prototype. Applications using these Axios versions on any platform running Node.js are susceptible.

The CVSS score of 6.3 indicates medium severity. Because the vulnerability only occurs when another component has already polluted Object.prototype, the likelihood of exploitation is restricted to environments combining Axios with vulnerable libraries. The flaw is not listed in the CISA KEV catalog, and the EPSS score of 0.00258 indicates a very low probability of exploitation. Attackers would need to establish prototype pollution in the same process before this behavior can be triggered.