Node axios: Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. (CVE-2026-44490)

Axios, a promise-based HTTP client for browser and Node.js, had two read-side prototype-pollution gadgets in versions before 0.32.0 and 1.16.0. First, in lib/utils.js, the merge() function's accumulator walks Object.prototype, copying polluted keys into HTTP headers sent by axios. Second, in lib/core/mergeConfig.js, the hasOwnProperty descriptor is constructed as a plain object literal, causing Object.defineProperty to access potentially polluted getter/setter functions on Object.prototype, which can throw synchronous TypeErrors on every axios request. These vulnerabilities are addressed in axios versions 0.32.0 and 1.16.0.

Exploitation of these vulnerabilities can lead to axios silently sending polluted header values, potentially affecting request integrity, or cause axios requests to fail with synchronous TypeErrors. There is no direct confidentiality impact, but the integrity and availability of HTTP requests made by axios can be affected.

Upgrade axios to version 0.32.0 or later, or 1.16.0 or later, where these prototype pollution issues are fixed. No other mitigation is indicated or required.