EUVD-2026-25609
GHSA-3w6x-2g7m-8v23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app using vulnerable Axios
-
DeliveryExploit existing prototype-pollution sink
-
ExploitSet Object.prototype.parseReviver to malicious reviver
-
ExecutionVictim app parses JSON responses
-
PersistReviver rewrites targeted fields invisibly
-
ImpactPrivilege escalation or data tampering
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V4 - API and Web Service Object attribute protection
|
| Exploitation Conditions | Exploitation requires a pre-existing Object.prototype pollution primitive somewhere in the application's dependency tree - the attacker must be able to set Object.prototype.parseReviver to a function; Axios itself provides no parseReviver default and performs no validation of it. The affected code path is the default transformResponse (lib/defaults/index.js:124) calling JSON.parse with the inherited reviver, so the target application must use Axios 1.0.0-1.15.1 to parse JSON responses (the default content handling). Limiting factors: without an independent prototype-pollution sink the gadget is unreachable (this is why SSVC marks Automatable: no and EPSS is 0.03%); requests that explicitly set parseReviver or do not parse JSON are unaffected; and impact is confidentiality/integrity only (A:N), not availability. |
| Impact | Signals conflict and must be weighed carefully. The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) treats the gadget in isolation once prototype pollution exists, but this is fundamentally a second-stage gadget: it is only exploitable when a separate prototype-pollution primitive already exists somewhere in the application's dependency tree, which realistically raises attack complexity. EPSS is very low (0.03%, 8th percentile) and SSVC marks Automatable: no with only partial Technical Impact and Exploitation: poc - all consistent with a powerful-but-conditional issue rather than a mass-exploited one. It is not in CISA KEV. A public PoC exists, so the technique is demonstrably workable, but exploitation depends entirely on a pre-existing pollution sink. Net: a genuinely high-impact integrity/confidentiality issue worth prompt patching given how widely Axios is deployed, but the real-world likelihood is gated by the presence of an independent prototype-pollution bug, so it is not a drop-everything emergency absent evidence of such a sink. |
| Exploit ScenarioDerived | An attacker first abuses a separate prototype-pollution flaw in one of the application's dependencies to set Object.prototype.parseReviver to a malicious function. From then on, every JSON response the app parses with Axios is silently passed through that reviver, letting the attacker flip a single field such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who can already pollute Object.prototype in a Node.js or browser application escalate that primitive into surgical, invisible rewriting of every parsed JSON API response, enabling privilege escalation, balance manipulation, and authorization bypass. The default transformResponse passes a prototype-inherited parseReviver to JSON.parse, so a planted Object.prototype.parseReviver runs against every key-value pair of every response. Publicly available exploit code exists (a PoC gist), though EPSS is very low (0.03%, 8th percentile) and the issue is not in CISA KEV.
Earlier versions of this analysis (4)
Prototype-pollution gadget in Axios 1.0.0 through 1.15.1 lets an attacker who already controls Object.prototype escalate that pollution into precise, invisible tampering of every JSON API response parsed by the client. The default transformResponse handler calls JSON.parse(data, this.parseReviver) with a config object that never defines or validates parseReviver, so a polluted Object.prototype.parseReviver runs as a reviver on each key/value pair, enabling selective rewriting of fields to achieve privilege escalation, balance manipulation, or authorization bypass. Publicly available exploit code exists (a published gist) and the issue is fixed in 1.15.2, though EPSS is very low (0.03%) and it is not in CISA KEV - there is no public exploit identified as actively exploited.
Authorization bypass and data tampering in the Axios HTTP client (1.0.0 through 1.15.1) lets an attacker who already controls a prototype-pollution primitive anywhere in the dependency tree weaponize Axios as the execution gadget. By polluting Object.prototype.parseReviver, the attacker hijacks the JSON.parse reviver used by the default transformResponse, enabling surgical, invisible modification of individual values in every JSON API response - including privilege flags, account balances, and authorization decisions - while leaving the rest of the payload intact. Publicly available exploit code exists and a vendor patch shipped in 1.15.2; EPSS is very low (0.03%) and the issue is not on CISA KEV, so no public exploit is identified as actively exploited at time of analysis.
JSON response tampering in the Axios HTTP client (versions 1.0.0 through 1.15.1) lets attackers escalate any pre-existing Object.prototype pollution in the app's dependency tree into surgical, near-invisible modification of every JSON API response Axios parses. Because the default transformResponse calls JSON.parse(data, this.parseReviver) and parseReviver is undefined in defaults and never validated, a polluted Object.prototype.parseReviver runs against every key/value pair of every response, enabling privilege escalation, balance manipulation, and authorization bypass while leaking original values. Rated CVSS 9.1, with publicly available exploit code, though EPSS is very low at 0.03%.
Prototype pollution in Axios JSON parsing allows attackers to manipulate JSON API responses through Object.prototype pollution in the dependency tree, enabling privilege escalation, balance manipulation, and authorization bypass on applications using affected versions 1.0.0 through 1.15.1. The vulnerability exploits the parseReviver callback parameter in the default transformResponse function, which processes every key-value pair in JSON responses without validation, permitting surgical modification of individual response values while remaining invisible to the application logic.
RemediationAI
Vendor-released patch: upgrade axios to 1.15.2 or later, which removes the prototype-inherited reviver behavior; this is the primary and complete fix (https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23). Red Hat consumers should apply the corresponding RHSA errata (e.g., https://access.redhat.com/errata/RHSA-2026:16534). Because the gadget is only reachable through a pre-existing prototype-pollution sink, an effective compensating control where immediate upgrade is impossible is to harden Object.prototype itself - freeze it at startup with Object.freeze(Object.prototype), which blocks the parseReviver pollution but can break libraries that legitimately extend prototypes, so test thoroughly. Auditing and patching dependencies for prototype-pollution sinks (the actual entry point) and explicitly setting parseReviver to undefined/a safe value on Axios configs are additional defenses; note that explicit config overrides only protect requests that pass through that config. Prefer the version upgrade, as workarounds leave the underlying gadget present.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Axios is a promise-based HTTP client used pervasively across the Node.js and browser JavaScript ecosystem. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), with the GHSA advisory also citing CWE-1321 (Prototype Pollution). The default transformResponse at lib/defaults/index.js:124 invokes JSON.parse(data, this.parseReviver), where this is the merged request config. Because parseReviver has no Axios default, is not validated by assertOptions, and is unconstrained, a polluted Object.prototype.parseReviver is silently inherited and invoked as the JSON reviver for every property of every JSON response. Unlike the older transformResponse gadget, the reviver has no 'must return true' constraint, can return arbitrary values for individual keys, sees original values before modifying them (enabling exfiltration), and leaves overall response structure intact. The single affected CPE is cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:* across the 1.0.0-1.15.2 range.
Know when Axios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because the gadget is only reachable given a pre-existing prototype-pollution primitive; PR:N/UI:N as no auth or interaction is needed thereafter; C:H/I:H for full response read/tamper, A:N as availability is unaffected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionNVD
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses - including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact. This vulnerability is fixed in 1.15.2.
Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
Executive ViewAI
Axios HTTP client versions 1.0.0 through 1.15.1 contain a critical vulnerability that allows attackers to intercept and manipulate JSON responses from APIs, potentially enabling unauthorized privilege escalation and account compromise. Organizations using affected Axios versions risk exposure of authentication flows, payment processing, and other business-critical API operations.
Apply vendor patch (upgrade to Axios 1.15.2 or later).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is
Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification
Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i
Exploit-DB