A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a Denial of Service (DoS) by causing requests to fail, alter outgoing serialized request data, or potentially execute arbitrary code if function injection is possible.
Last checked: 2026-10-01 15:34 UTC
Proof of concept · CISA Coordinator (Assessed 2026-10-01 14:44 UTC)
Fix evidence last checked: 2026-10-02 22:13 UTC