A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP (Hypertext Transfer Protocol) headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios fetch adapter improperly processes inherited configuration methods on request data. Consequently, an attacker can tamper with outgoing requests, potentially bypassing security controls, altering authentication tokens, or modifying backend service behavior.
Last checked: 2026-09-30 21:40 UTC
Proof of concept · CISA Coordinator (Assessed 2026-09-28 17:48 UTC)
Fix evidence last checked: 2026-10-04 00:33 UTC
Debian 12 (Bookworm)
Debian Security Tracker · Observed 2026-10-04