The axios HTTP client in Node.js environments using the HTTP adapter is vulnerable to prototype pollution that enables an attacker to control the proxy through which requests are routed. axios attempts to harden the merged request configuration by using a null-prototype object, but request interceptors that run after the merge can revert this hardening by creating a regular object from the config. This allows the Node HTTP adapter to read the proxy setting through the prototype chain. If an attacker can inject a proxy property into Object.prototype, they can redirect requests through an attacker-controlled proxy. This affects plaintext HTTP requests, exposing Authorization headers, Basic auth credentials, HTTP method, URL, Host header, and request body to the proxy. The vulnerability does not impact HTTPS requests under normal TLS validation. The affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).

An attacker able to pollute Object.prototype.proxy can redirect HTTP requests made by axios through a proxy they control, exposing sensitive request data including Authorization headers and request bodies. This can lead to information disclosure for plaintext HTTP traffic. The vulnerability does not affect HTTPS traffic under normal TLS validation and does not impact browser environments. There are no known exploits in the wild at this time.

Upgrade axios to version 0.33.0 or later if using the 0.x series, or to version 1.18.0 or later if using the 1.x series. These versions include fixes that properly harden the request configuration and prevent prototype pollution from affecting the proxy setting. Until upgraded, avoid using axios in environments where Object.prototype can be polluted or restrict untrusted code execution that could modify Object.prototype.proxy.