CVE-2026-44490

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.32.0 Axios versions prior to 1.16.0

Description Axios contains two read-side prototype pollution gadgets. Prototype pollution occurs when an attacker or a dependency modifies the base Object prototype, allowing properties to be inherited by all objects in the process. If Object.prototype is polluted by an upstream dependency, Axios silently adopts these polluted values. In the merge() function within lib/utils.js, the accumulator is built as a plain object, causing result[targetKey] to traverse the prototype chain and copy polluted keys into merged headers. Additionally, in lib/core/mergeConfig.js, the hasOwnProperty descriptor is built as a plain-object literal; since Object.defineProperty reads descriptor.get and descriptor.set via the prototype chain, polluted Object.prototype.get or Object.prototype.set properties cause a synchronous TypeError on every request.

Recommendations Update to version 0.32.0 or later. Update to version 1.16.0 or later.