REDHAT-BUG-2487942: High severity npm/axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487942?
The severity of REDHAT-BUG-2487942 is classified as high with a score of 7.
What is the impact of the vulnerability REDHAT-BUG-2487942?
The impact of the vulnerability REDHAT-BUG-2487942 allows for a Prototype Pollution attack that can escalate to a full Man-in-the-Middle (MITM) attack.
Which versions of Axios are affected by REDHAT-BUG-2487942?
The REDHAT-BUG-2487942 vulnerability affects Axios versions from 1.0.0 to just before 1.16.0.
How do I fix REDHAT-BUG-2487942?
To fix REDHAT-BUG-2487942, update Axios to version 1.16.0 or later.
What are the potential consequences of exploiting REDHAT-BUG-2487942?
Exploiting REDHAT-BUG-2487942 can lead to unauthorized manipulation of an application's object prototypes and possible interception of sensitive data.