A flaw was found in axios. When running in Node.js, the HTTP adapter does not define an explicit connection creation setting on outgoing request options. If a separate prototype-pollution flaw is exploited in the same process, an attacker can hijack the network socket by injecting a malicious connection handler. This allows the attacker to redirect outbound requests to an attacker-controlled server, resulting in information disclosure of sensitive credentials and the ability to return forged responses.
Last checked: 2026-10-01 15:34 UTC
Proof of concept · CISA Coordinator (Assessed 2026-10-01 14:42 UTC)
Fix evidence last checked: 2026-09-28 20:20 UTC