Prototype Pollution Vulnerability in Axios Request Interceptors

• •Axios request interceptors can be exploited for prototype pollution.
• •Attackers can inject headers into requests if interceptors omit their own headers property.
• •The vulnerability is conditional and does not affect all requests or interceptors.

A vulnerability in Axios request interceptors allows for prototype pollution, potentially enabling attackers to inject malicious headers into requests. If an interceptor returns a plain object without its own headers property, the dispatchRequest function may read from the inherited Object.prototype.headers. This issue arises when a prior prototype pollution primitive is present in the same process. The vulnerability affects Axios versions where interceptors can return a new ordinary object without headers. The problem is conditional, not affecting all interceptors or requests. Affected functionality includes request interceptor chains that return new ordinary objects and replacement config objects that lack an own headers property. The issue was verified locally on Axios version 1.18.1. Users are advised to ensure interceptors set their own headers property to mitigate this risk.