EUVD-2026-25609
GHSA-3w6x-2g7m-8v23
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
AC:H because the gadget is only reachable given a pre-existing prototype-pollution primitive; PR:N/UI:N as no auth or interaction is needed thereafter; C:H/I:H for full response read/tamper, A:N as availability is unaffected.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
14Blast Radius
ecosystem impact- 273 npm packages depend on axios (189 direct, 84 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionNVD
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses - including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact. This vulnerability is fixed in 1.15.2.
AnalysisAI
JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who can already pollute Object.prototype in a Node.js or browser application escalate that primitive into surgical, invisible rewriting of every parsed JSON API response, enabling privilege escalation, balance manipulation, and authorization bypass. The default transformResponse passes a prototype-inherited parseReviver to JSON.parse, so a planted Object.prototype.parseReviver runs against every key-value pair of every response. Publicly available exploit code exists (a PoC gist), though EPSS is very low (0.03%, 8th percentile) and the issue is not in CISA KEV.
Technical ContextAI
Axios is a promise-based HTTP client used pervasively across the Node.js and browser JavaScript ecosystem. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), with the GHSA advisory also citing CWE-1321 (Prototype Pollution). The default transformResponse at lib/defaults/index.js:124 invokes JSON.parse(data, this.parseReviver), where this is the merged request config. Because parseReviver has no Axios default, is not validated by assertOptions, and is unconstrained, a polluted Object.prototype.parseReviver is silently inherited and invoked as the JSON reviver for every property of every JSON response. Unlike the older transformResponse gadget, the reviver has no 'must return true' constraint, can return arbitrary values for individual keys, sees original values before modifying them (enabling exfiltration), and leaves overall response structure intact. The single affected CPE is cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:* across the 1.0.0-1.15.2 range.
RemediationAI
Vendor-released patch: upgrade axios to 1.15.2 or later, which removes the prototype-inherited reviver behavior; this is the primary and complete fix (https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23). Red Hat consumers should apply the corresponding RHSA errata (e.g., https://access.redhat.com/errata/RHSA-2026:16534). Because the gadget is only reachable through a pre-existing prototype-pollution sink, an effective compensating control where immediate upgrade is impossible is to harden Object.prototype itself - freeze it at startup with Object.freeze(Object.prototype), which blocks the parseReviver pollution but can break libraries that legitimately extend prototypes, so test thoroughly. Auditing and patching dependencies for prototype-pollution sinks (the actual entry point) and explicitly setting parseReviver to undefined/a safe value on Axios configs are additional defenses; note that explicit config overrides only protect requests that pass through that config. Prefer the version upgrade, as workarounds leave the underlying gadget present.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today