Axios EUVD-2026-25607

Upgrade Axios to version 1.15.1 or later for the 1.x branch, or 0.31.1 or later for the 0.x branch. These versions implement strict boolean comparison (if (config.withXSRFToken === true)) instead of truthy/falsy evaluation. Refer to the official GitHub Security Advisory at https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c for detailed patching instructions. If immediate patching is not feasible, implement the following compensating controls: (1) Audit and lock your application's Axios configuration to ensure withXSRFToken is never set to non-boolean values-enforce this via configuration validation at application startup to catch misconfigurations early; (2) Disable or implement strict controls on prototype pollution attack surfaces by using Object.freeze() on configuration objects, Object.preventExtensions() on prototype chains, or adopting a library like deepfreeze for immutable config; (3) Implement Content Security Policy (CSP) headers with strict-dynamic and nonce-based script whitelisting to prevent unauthorized XSS-based prototype pollution attacks that could inject values into the Axios config; (4) Monitor HTTP request headers in your application logs for unexpected XSRF token presence in cross-origin requests and alert on anomalies. Note that workaround (2) introduces performance overhead and may conflict with legitimate dynamic configuration patterns, and workaround (3) requires browser support and careful rollout to avoid breaking legitimate functionality.