AIKIDO-2026-10509

TL;DR

Affected versions of this package are vulnerable to prototype pollution–based header injection due to unsafe FormData detection and header merging logic. The affected implementation may treat attacker-controlled plain objects as valid FormData instances and invoke inherited getHeaders methods from polluted prototypes, allowing malicious headers such as forged authorization values to be merged into outbound requests. In addition, query parameter encoding improperly handles null-byte values, which can lead to unexpected parameter transformations. An attacker able to influence object prototypes or request data can inject unauthorized headers or manipulate request processing.