CVE-2026-44490: Axios Prototype Pollution via Merge and Property Descriptor Gadgets

Technical summary

The vulnerability manifests in two distinct code paths. First, axios's merge() utility in lib/utils.js initializes an accumulator object and copies keys from Object.prototype when it has been polluted; these polluted values then propagate into HTTP request headers. Second, lib/core/mergeConfig.js defines a property descriptor as a plain object literal, allowing Object.defineProperty to read getter/setter functions from a polluted prototype chain, triggering a synchronous TypeError during descriptor setup on every request. Both issues are gadget-class—they require upstream prototype pollution (e.g., from lodash_.merge or similar) to be exploited in the same process context. The root cause is insufficient isolation of prototype chain lookups from user-controlled or polluted data.

Business impact

The business risk depends on your supply-chain composition. If your application uses axios alongside a vulnerable dependency that pollutes Object.prototype, you face two distinct failure modes: silent data leakage (where internal or sensitive header values escape to the wire) or denial of service (where every axios request fails with an uncaught TypeError, disrupting service availability). In a multi-tenant or API-driven environment, this could expose request metadata or cause cascading outages. However, the impact is constrained by the requirement for upstream pollution—direct network attackers cannot trigger these gadgets without prior code execution or supply-chain compromise.

Affected systems

axios versions 0.x prior to 0.32.0 and 1.x prior to 1.16.0 are affected. Any Node.js or browser-based application bundling axios alongside a prototype-pollution source (e.g., lodash <4.17.21) is at risk. This includes backend APIs, CLI tools, Electron apps, and frontend build tooling that uses axios for HTTP operations. The vulnerability does not affect axios 0.32.0, 1.16.0, or later versions.

Exploitability

Exploitability is constrained but not zero. An attacker cannot remotely exploit this vulnerability in isolation—it requires that Object.prototype is already polluted by an upstream dependency in the same process. The practical attack vector is supply-chain compromise: a malicious or compromised npm package could pollute the prototype and then trigger the axios gadgets to leak data or cause denial of service. The CVSS score of 4.8 (MEDIUM) reflects this; integrity and availability are impacted, but only under the specific precondition of upstream pollution. Direct remote exploitation without prior code execution is not feasible.

Remediation

Upgrade axios to 0.32.0 (for the 0.x line) or 1.16.0 (for the 1.x line) or later. Simultaneously, audit and upgrade all upstream dependencies, particularly lodash, to versions that do not pollute Object.prototype (lodash 4.17.21 or later). Implement npm audit and lockfile review practices to prevent introduction of vulnerable transitive dependencies. Consider using npm's allow/deny list policies or namespace isolation techniques if you operate a large monorepo or managed application portfolio.

Patch guidance

The fix is straightforward: update axios to the patched versions listed above. There are no known compatibility issues or breaking changes in the patched releases. If you use yarn, npm, or pnpm, run upgrade axios and re-lock your dependencies. Verify that your lockfile reflects the new versions before deploying. If you cannot upgrade immediately, isolate axios from untrusted code paths and ensure your dependency tree is free of known prototype-pollution sources (verify this with npm audit --production and manual code review of critical paths).

Detection guidance

Monitor for TypeError exceptions originating from axios operations, particularly in mergeConfig() or merge() calls. Check application logs for patterns like 'Cannot read property get/set of undefined' or similar descriptor-related errors. Scan your node_modules tree and package-lock.json for vulnerable versions of axios and for upstream polluters such as lodash <4.17.21. Use software composition analysis (SCA) tools like Snyk, WhiteSource, or Dependabot to flag outdated dependencies. In a containerized environment, build-time scanning of npm metadata before deployment can catch these issues before they reach production.

Why prioritize this

Although CVSS is MEDIUM and KEV inclusion is false, this vulnerability warrants prompt attention because it targets a ubiquitous HTTP client in JavaScript ecosystems. The gadget-class nature means it is low-severity in isolation but becomes critical if combined with upstream pollution—a scenario that is realistic in complex supply chains. Prioritize this fix if your application uses axios for critical API communication or if you operate in a high-risk supply-chain environment (e.g., publishing packages to npm, running untrusted code, or depending on many transitive packages).

Risk score, explained

The CVSS 3.1 score of 4.8 (MEDIUM) reflects a network-accessible vulnerability with high attack complexity (AC:H)—the requirement for prior prototype pollution constrains the likelihood of exploitation in the wild. There is no confidentiality impact (C:N), but integrity (I:L) and availability (A:L) are degraded if the preconditions are met. The score appropriately penalizes the constraint of requiring upstream pollution while acknowledging that silent data leakage and denial of service are real when that precondition holds.

Frequently asked questions