REDHAT-BUG-2487942: High severity npm/axios vulnerability

Published Jun 11, 2026
·
Updated

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

Affected Software

1 affected component
npm/axios>=1.0.0<1.16.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade axios to a version that resolves this vulnerability.

    Fixed in 1.16.0

Event History

Jun 11, 2026
Data Sourced
via Red Hat·05:01 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2487942?

The severity of REDHAT-BUG-2487942 is classified as high with a score of 7.

2

What is the impact of the vulnerability REDHAT-BUG-2487942?

The impact of the vulnerability REDHAT-BUG-2487942 allows for a Prototype Pollution attack that can escalate to a full Man-in-the-Middle (MITM) attack.

3

Which versions of Axios are affected by REDHAT-BUG-2487942?

The REDHAT-BUG-2487942 vulnerability affects Axios versions from 1.0.0 to just before 1.16.0.

4

How do I fix REDHAT-BUG-2487942?

To fix REDHAT-BUG-2487942, update Axios to version 1.16.0 or later.

5

What are the potential consequences of exploiting REDHAT-BUG-2487942?

Exploiting REDHAT-BUG-2487942 can lead to unauthorized manipulation of an application's object prototypes and possible interception of sensitive data.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203