Node axios: From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Object.prototype… (CVE-2026-44489)

Axios, a promise-based HTTP client for Node.js and browsers, versions 1.15.2 to before 1.16.0 construct nested objects (such as config.proxy) as plain objects inheriting from Object.prototype. The setProxy() function reads proxy.username, proxy.password, and proxy.auth without verifying ownership via hasOwnProperty checks. If Object.prototype is polluted with attacker-controlled properties like username, setProxy() will create a Proxy-Authorization header with these malicious credentials and inject it into every proxied HTTP request. This vulnerability is resolved in Axios 1.16.0.

An attacker who can pollute Object.prototype with properties such as username can cause Axios to send attacker-controlled Proxy-Authorization headers in proxied HTTP requests. This leads to unauthorized injection of credentials in HTTP proxy authentication headers, potentially allowing unauthorized access or manipulation of proxied requests. There is no direct impact on confidentiality or availability indicated, but integrity of proxied requests is compromised.

Upgrade Axios to version 1.16.0 or later, where this vulnerability is fixed. The fix ensures nested objects are not plain objects inheriting from Object.prototype and that setProxy() properly handles proxy credentials without relying on potentially polluted prototype properties.