Description
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | >= 1.0.0, < 1.15.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.15.2-1 | — |
| Debian 13 | node-axios | No fix yet | — |
| Debian 12 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | 1.13.2+dfsg-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 24.04 LTS | node-axios | 1.6.8+dfsg-2ubuntu0.1~esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | agama-web-ui | 17+612.d8bf69336-160000.11.1 | openSUSE-SU-2026:20919-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r22 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r21 | — |
| Wolfi rolling | langfuse-3 +1 | 3.174.1-r0 | — |
| Wolfi rolling | lerna | 9.0.7-r4 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r0 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.6.0-r3 | — |
| Wolfi rolling | prism | 5.15.10-r0 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.0.0, < 1.15.2 | 1.15.2 | GHSA-q8qp-cvcw-x6jj |
Advisories 6
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-1687 IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 1, 2026
- WID-SEC-2026-2169 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 30, 2026
- WID-SEC-2026-1654 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- openSUSE-SU-2026:20919-1 Security update for agama-web-ui SUSE / openSUSE Security Updates · Jun 10, 2026