CVE-2026-44494: Axios Prototype Pollution to MITM Gadget Chain (v1.0.0–1.15.x)

Technical summary

The vulnerability stems from how Axios resolves the proxy configuration in its HTTP adapter. At lib/adapters/http.js:670, the code reads config.proxy via standard property access, which follows JavaScript's prototype chain lookup. Since proxy is not included in Axios's default configuration object, a merged config will lack an own proxy property. This design allows an attacker who has achieved prototype pollution elsewhere in the dependency tree to inject a proxy property at Object.prototype. When Axios later reads config.proxy, it retrieves the injected value, and setProxy() routes subsequent HTTP requests through the attacker-controlled proxy. The gadget chain is trivial: any prototype pollution → proxy injection → automatic MITM setup.

Business impact

Organizations using vulnerable Axios versions face exposure to complete HTTP traffic compromise, including exfiltration of API keys, session tokens, and authentication credentials embedded in request headers. In supply-chain contexts, backend services using Axios for inter-service communication or API calls become MITM targets. Attackers can modify responses to inject malicious payloads, redirect users, or exfiltrate sensitive data in real time. The severity is amplified because the attack requires only prototype pollution somewhere in the dependency tree—a common vulnerability class—rather than direct access to Axios configuration.

Affected systems

Axios versions 1.0.0 through 1.15.x are vulnerable. This includes all minor and patch releases within that range. Applications running on both browser and Node.js environments are at risk. Particularly high-risk deployments include: microservices architectures where services make HTTP calls via Axios; backend applications calling third-party APIs; and frontend apps in environments with prototype pollution vectors in their dependency tree.

Exploitability

Exploitation requires a two-stage attack. First, the attacker must trigger or chain a separate prototype pollution vulnerability in the application's broader dependency tree—a surprisingly common class of flaw. Once prototype pollution is achieved, injecting a malicious proxy configuration into Axios is trivial and automatic; no special interaction or user action is needed. HTTP requests made by the affected application thereafter are transparently routed through the attacker's proxy. The CVSS score of 8.7 (HIGH) reflects the severity of the impact (full confidentiality and integrity compromise across the network boundary) balanced against the attack complexity (requiring a separate prototype pollution vector).

Remediation

Upgrade Axios to version 1.16.0 or later. This release hardens the proxy configuration handling to prevent prototype chain traversal. Additionally, audit your dependency tree for other prototype pollution vulnerabilities and apply patches for those as well, to reduce the window for multi-stage attacks. Consider using dependency scanning tools to detect prototype pollution flaws in transitive dependencies.

Patch guidance

Apply the official Axios patch by updating to 1.16.0 or newer. For npm-managed projects, run `npm update axios` or manually specify `axios@^1.16.0` in package.json and reinstall. For yarn, run `yarn upgrade axios`. Verify the upgrade in your lock file (package-lock.json or yarn.lock). No configuration changes are required; the fix is transparent. For applications with pinned dependencies, explicitly bump the Axios version to 1.16.0 or higher, then run your test suite to confirm compatibility.

Detection guidance

Monitor network traffic from your applications for unexpected proxy configurations or routing through unfamiliar proxies. In Node.js environments, log or inspect the Axios config object at runtime to detect injected proxy properties. Implement prototype pollution detection via static analysis tools (e.g., npm audit, Snyk) to identify vulnerable dependencies that could enable the first stage of attack. Also review code for explicit calls to `Object.preventExtensions()` or `Object.freeze()` on the config object, which would mitigate even if prototype pollution occurs elsewhere.

Why prioritize this

This is a high-priority vulnerability because it enables passive, transparent MITM attacks once prototype pollution is achieved elsewhere in the dependency tree. The attack has no user interaction requirement and yields complete confidentiality and integrity compromise of HTTP traffic. Prototype pollution flaws are common, making the two-stage attack path realistic. Organizations should prioritize patching Axios because it is a foundational dependency in many JavaScript projects, and the fix is straightforward and non-breaking.

Risk score, explained

The CVSS 3.1 score of 8.7 reflects HIGH severity. Attack Vector is Network (the polluted prototype is leveraged remotely), Attack Complexity is High (prototype pollution must occur first), Privileges Required and User Interaction are None, Scope is Changed (the attack crosses trust boundaries), Confidentiality and Integrity impacts are High (all HTTP traffic can be read and modified), and Availability is None. The score appropriately captures that while the attack is powerful and requires no user interaction, its exploitation depends on a pre-existing prototype pollution vector.

Frequently asked questions