GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
SummaryAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.ImpactThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.Affected FunctionalityAffected runtime functionality:Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`.Query serialization through `lib/helpers/buildURL.js`.`axios.getUri()` when called with an affected `paramsSerializer` object.Affected config shapes:`auth: {}` or an `auth` object missing own `username` and/or `password`.`paramsSerializer: {}` or a `paramsSerializer` object missing own `encode` and/or `serialize`.Unaffected by this specific issue:Requests with no `auth` property.Requests with no `paramsSerializer` property.Top-level polluted `auth` or `paramsSerializer` values in current hardened versions.Technical Details`lib/core/mergeConfig.js` creates the top-level merged config with `Object.create(null)`, but nested object cloning still uses ordinary `{}` containers:Downstream code then reads nested fields without own-property checks.In `lib/helpers/resolveConfig.js`:In `lib/adapters/http.js`:In `lib/helpers/buildURL.js`:Proof of Concept of AttackObserved result:WorkaroundsIf upgrading is not yet possible, avoid passing placeholder nested option objects.Remove `auth` entirely when Basic auth is not intended. For `paramsSerializer` objects, provide explicit own `encode` and `serialize` properties or remove `paramsSerializer` when custom serialization is not required.These workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.Summaryaxios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer: {}, axios reads inner fields (username, password, encode, serialize) through the prototype chain. If Object.prototype has been polluted by another component in the same Node.js process, those inherited values are silently injected into the outbound request, including the Authorization header and the serialized query string.DetailsmergeConfig (lib/core/mergeConfig.js) was hardened to use a null-prototype container for the top-level config, but its nested-clone helper still produces ordinary {} containers:mergeConfig.js Lines 36-45The cloned nested objects therefore inherit from Object.prototype. Downstream consumers read sensitive fields via plain dotted access, with no own-property guard:Browser / fetch Basic auth — lib/helpers/resolveConfig.js:
resolveConfig.js Lines 64-70Node HTTP adapter Basic auth — lib/adapters/http.js:
http.js Lines 829-836paramsSerializer reads — lib/helpers/buildURL.js:
buildURL.js Lines 31-54Because auth.username, auth.password, options.encode, and options.serialize are accessed without hasOwnProperty checks, a polluted Object.prototype.username / Object.prototype.password / Object.prototype.serialize flows directly into the outgoing request.The auth sink is the primary impact (silent Basic-auth injection); paramsSerializer.serialize is a secondary but powerful sink because it can fully replace the query string.PoCImpactConcrete consequences:Silent injection of attacker-controlled Authorization: Basic … headers on outbound requests, enabling credential exfiltration to attacker-chosen upstreams or impersonation against trusted upstreams.Full takeover of query-string serialization via paramsSerializer.serialize, enabling request tampering, cache-key poisoning, and bypass of upstream signature/policy checks that sign the literal request line.
CVSS v4.0 score: 6.3