Axios is affected by a vulnerability where read-side prototype pollution gadgets can influence request construction when Object.prototype has been polluted externally. In particular, bodyless method aliases (e.g., axios.get(), axios.delete()) read inherited data before config normalization, potentially sending attacker-controlled bodies on requests that should not have them. Additional low-level paths, reachable only when calling exported adapters or helpers directly with plain configs, can inherit polluted proxy or paramsSerializer values, enabling routing through attacker-controlled proxies or URL serialization manipulation. These low-level issues do not occur through normal high-level axios calls on versions 1.15.2 and later. The vulnerability is resolved in axios versions 1.18.0 and 0.33.0.

An attacker who can cause Object.prototype to be polluted by a separate vulnerability or dependency may manipulate axios requests to include unintended request bodies or route requests through attacker-controlled proxies. This can lead to unexpected request behavior and potential security risks in applications using affected axios versions. However, exploitation requires prior prototype pollution and specific usage patterns, limiting the attack surface.

Upgrade axios to version 1.18.0 or later, or 0.33.0 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in these versions.