A high-severity prototype pollution vulnerability in the Axios HTTP client allows unauthenticated attackers to intercept data or hijack requests, posing a significant risk to application integrity.

This is a prototype pollution vulnerability (CWE-1321) occurring because Axios lacks proper hasOwnProperty guards when reading keys. An unauthenticated attacker can exploit this behavior if a separate co-dependency has already polluted the Object.prototype.

Successful exploitation allows an attacker to silently intercept and modify sensitive JSON responses or fully hijack the underlying HTTP transport. This results in potential unauthorized access to request credentials, headers, and request bodies. With a CVSS score of 7.4, this vulnerability represents a significant risk to data confidentiality and integrity, potentially leading to complete compromise of sensitive information processed by the application.

Immediate Action: Update the Axios package to version 1.15.1 or 0.31.1 immediately to incorporate the required hasOwnProperty guards.

Proactive Monitoring: Review application logs for unexpected changes in outgoing request headers or inconsistencies in incoming JSON response structures that may indicate interception.

Compensating Controls: Ensure all dependencies within the application process are audited for prototype pollution vulnerabilities, as this flaw requires a separate source of pollution to be triggered.

Public Exploit Available: No confirmed public exploit (none identified in current enrichment data).

Given the potential for complete request hijacking and data interception, this vulnerability requires immediate attention. Security teams should prioritize updating Axios to the patched versions across all development and production environments. Furthermore, developers should perform a thorough audit of all project dependencies to ensure no other packages are introducing prototype pollution into the runtime environment.