The vulnerability in axios before 0.33.0 and 1.x before 1.18.0 arises from the consumption of inherited properties from nested request option objects when the global Object.prototype has been polluted. While the top-level config uses a null prototype to prevent such issues, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects that do not perform own-property checks. This can lead to silent injection of Authorization: Basic headers if inherited username/password properties exist, or modification of query-string serialization if inherited encode/serialize functions are present. Exploitation is contingent on prior prototype pollution in the JavaScript environment, making this a secondary effect rather than a direct prototype pollution vulnerability.

If exploited in an environment with existing prototype pollution, an attacker could cause axios to silently inject unintended Authorization headers or alter query-string serialization behavior. This may lead to unauthorized access or data manipulation in HTTP requests made by the application. However, the vulnerability requires a precondition of prototype pollution, limiting its direct impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running axios in environments where Object.prototype may be polluted or ensure that prototype pollution vulnerabilities are mitigated in the application. Monitor vendor channels for updates regarding patches for axios versions before 0.33.0 and 1.x before 1.18.0.