Chan154

**Name of the Vulnerable Software and Affected Versions** Axios versions 0.28.0 through 0.33.x Axios versions 1.15.1 through 1.19.x **Description** ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution, a condition where an attacker can manipulate the prototype of an object to inject properties. A separate same-process prototype pollution flaw allows the supply of inherited `dots`, `indexes`, `metaTokens`, `maxDepth`, `visitor`, or `Blob` values before object serialization. These inherited options can alter field naming and data interpretation in toFormData, while `maxDepth` can force request failure and `Blob` can change value handling. Additionally, a polluted `visitor` can execute if an attacker possesses the ability to inject a function. **Recommendations** Update to version 0.34.0. Update to version 1.20.0.