Prototype Pollution in Axios
CVE-2026-44490
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the merged headers and ride out on the wire. (2) lib/core/mergeConfig.js line 26 builds the hasOwnProperty descriptor as a plain-object literal. Object.defineProperty reads descriptor.get/descriptor.set via the prototype chain, so a polluted Object.prototype.get or Object.prototype.set makes the call throw TypeError synchronously on every axios request. This vulnerability is fixed in 0.32.0 and 1.16.0.
Vulnerability class: Prototype Pollution
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (33.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Axios — versions >= 1.0.0, < 1.16.0, < 0.32.0
Weakness classification (CWE)
References
- github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-44490?
- CVE-2026-44490 is a medium-severity vulnerability in Axios, classified under Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). CVSS score: 4.8/10. Published 2026-06-11.
- How severe is CVE-2026-44490?
- Medium severity. CVSS v3 base score is 4.8 out of 10.