Lullu57

**Name of the Vulnerable Software and Affected Versions** axios versions 1.15.2 through 1.17.x **Description** axios contains prototype-pollution read-side gadgets in its Basic authentication subfield handling within `lib/adapters/http.js` and `lib/helpers/resolveConfig.js`. While axios does not pollute prototypes itself, it is vulnerable if the host application is already affected by a separate prototype-pollution primitive. When a request is made using an `auth` object that omits the `username` and/or `password` properties, axios reads the inherited `Object.prototype.username` and `Object.prototype.password` values to construct the outbound 'Authorization: Basic ...' header. This allows an attacker who controls the polluted prototype values to perform outbound request tampering by injecting attacker-chosen Basic auth credentials or replacing an existing Authorization header. Under specific application conditions, this could lead to credential disclosure. **Recommendations** Avoid passing empty or partial `auth` objects; only set `auth` when the application has its own `username` and `password` values. Applications that merge untrusted input should filter ` proto `, `constructor`, and `prototype` keys. Read optional user options using own-property checks instead of patterns like `opts.auth || {}`. When a wrapper must materialize optional authentication, use a null-prototype object or explicitly copy only own fields.

**Name of the Vulnerable Software and Affected Versions** Python-Multipart versions prior to 0.0.31 **Description** The `parse form()` function fails to validate the `Content-Length` header before using it to limit the chunked read of the request body. Because the header value is parsed as an integer without a sign check, a negative `Content-Length` (such as `-1`) causes the `input stream.read()` operation to read until the end of the stream (EOF). This results in the entire request body being loaded into memory in a single unbounded read instead of fixed-size chunks, which can degrade system availability under concurrent requests. **Recommendations** Update to version 0.0.31 or later.