Node axios: From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. (CVE-2026-44495)

Axios, a promise-based HTTP client for Node.js and browsers, has prototype-pollution gadgets in request config processing in versions from 0.19.0 to before 0.31.1 and 1.15.2. If Object.prototype.transformResponse is polluted by another vulnerability or attacker control before Axios creates a request, Axios may treat that inherited value as part of the request configuration or option validation. Axios itself does not cause prototype pollution, so exploitation depends on a separate prototype pollution vulnerability existing in the same JavaScript process. The vulnerability is resolved in Axios versions 0.31.1 and 1.15.2.

An attacker who has already achieved prototype pollution in the JavaScript environment can leverage this vulnerability to influence Axios request configuration or option validation, potentially leading to high confidentiality impact, limited integrity impact, and high availability impact. However, Axios does not independently create prototype pollution, so exploitation requires a prior vulnerability or control over Object.prototype.

This vulnerability is fixed in Axios versions 0.31.1 and 1.15.2. Users should upgrade to these or later versions to remediate the issue. Since Axios does not itself create prototype pollution, addressing any existing prototype pollution vulnerabilities in the environment is also critical. No additional mitigation is indicated by the vendor advisory.