AIKIDO-2026-936429
axios is vulnerable to Prototype Pollution
59
Medium Risk
This Affects:
axiosTL;DR
The Node HTTP adapter builds its redirect options with a plain beforeRedirects: {} object, so dispatchBeforeRedirect looks up its hook on an object that still inherits from Object.prototype. A polluted prototype property reachable at the key the redirect dispatcher checks can therefore run during a redirect and rewrite the request's destination, host, or headers before the redirected request is sent. The fix builds beforeRedirects on a null-prototype object so no inherited hook is reachable.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a separate prototype-pollution primitive elsewhere in your application can reach Object.prototype.
Background info
axios is vulnerable to Prototype Pollution in versions 0.28.0 - 0.33.0.
How to fix this
Upgrade the axios library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.