Disclosure summary
## Summary Axios default-instance requests that omit an explicit method can read an inherited `method` value from `Object.prototype`. If another vulnerability in the same process pollutes `Object.prototype.method`, calls such as `axios.request({ url })` and `axios({ url })` can send a state-changing HTTP method instead of the expected default `GET`. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. ## Impact In an affected application with a separate prototype-pollution primitive, an attacker can change axios default-instance requests that omit `method` from `GET` to methods such as `DELETE`, `POST`, `PUT`, or `PATCH`. The practical impact depends on the target endpoint and can include unintended writes, deletion, or other state changes. Method aliases such as `axios.get(url)` and requests with an explicit own `method` are not affected by the confirmed method path. ## Affected Functionality Affected: - Default axios instance calls: `axios.request({ url })`. - Callable shorthand: `axios({ url })`. - Requests where no own `config.method` is provided. Not affected in the confirmed method PoC: - `axios.get(url)` and other method
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-9fr6-4gfg-395g
Open original source · Updated Sep 30, 2026
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Source severity: MEDIUM / 6.9
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | axios | >= 0.27.2, < 0.34.0 | 0.34.0 |
| npm | axios | >= 1.0.0, < 1.20.0 | 1.20.0 |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Reviewed advisory
PUBLISHED 2026-09-30T11:12:49-04:00
MODIFIED 2026-09-30T11:12:50-04:00
INGESTED 2026-10-06T11:43:09-04:00