A critical prototype pollution vulnerability in the Axios HTTP client allows unauthenticated attackers to perform HTTP header injection, potentially leading to unauthorized data exfiltration or manipulation.

This vulnerability involves a prototype pollution gadget located in the lib/adapters/http.js file, which misidentifies object payloads as FormData instances. By leveraging existing prototype pollution primitives, an unauthenticated attacker can force the application to execute attacker-controlled functions, resulting in the injection of malicious HTTP headers.

Successful exploitation allows an attacker to manipulate outgoing HTTP requests, which may facilitate server-side request forgery or the bypassing of security controls that rely on specific header values. Given the CVSS score of 7.4, this vulnerability poses a significant risk to the integrity of outgoing communications and the overall security posture of applications utilizing the affected Axios versions.

Immediate Action: Update the Axios package to version 1.15.1 or 0.31.1 immediately to incorporate the necessary patches for lib/adapters/http.js.

Proactive Monitoring: Review application logs for unusual HTTP header structures or unexpected outgoing traffic patterns that may indicate attempts to leverage header injection.

Compensating Controls: Ensure that no other dependencies within the application environment are susceptible to prototype pollution, as this vulnerability requires an existing pollution primitive to trigger the gadget.

Public Exploit Available: Unknown.

Organizations must prioritize the update of the Axios library to the specified fixed versions to eliminate the prototype pollution gadget. Because this flaw can be triggered by vulnerabilities in other project dependencies, a comprehensive audit of the entire software supply chain is recommended to ensure no underlying prototype pollution primitives remain active.