How HTTP Transport Hijacking via Prototype Pollution happens in Node.js axios and how to fix it

How HTTP Transport Hijacking via Prototype Pollution Happens in Node.js axios and How to Fix It

In the admin panel's package dependencies, we discovered a high-severity prototype pollution vulnerability in axios 1.15.0 that could allow attackers to hijack HTTP transport configuration. This vulnerability—CVE-2026-42033—affects how axios handles request configuration objects, creating a pathway for malicious input to traverse and pollute the JavaScript prototype chain. When exploited, an attacker could intercept, modify, or redirect HTTP requests made by the admin panel, potentially compromising API communication, stealing authentication tokens, or performing man-in-the-middle attacks.

Understanding the Vulnerability

Prototype pollution is a JavaScript-specific vulnerability that occurs when an application unsafely merges user-controlled objects into existing objects without proper validation. In axios, the vulnerability existed in how the library merged request configuration parameters into its internal transport configuration object.

Here's what happened in axios 1.15.0:

// Vulnerable pattern in axios 1.15.0
// When merging user-provided config into transport config:
function mergeConfig(target, source) {
  for (const key in source) {
    if (source.hasOwnProperty(key)) {
      target[key] = source[key];  // Unsafe assignment
    }
  }
  return target;
}

// An attacker could pass config like:
const maliciousConfig = {
  "__proto__": {
    "httpAgent": attacker_controlled_agent,
    "httpsAgent": attacker_controlled_agent
  }
};

// This would pollute Object.prototype, affecting ALL objects:
// Object.prototype.httpAgent = attacker_controlled_agent

The problem is that the key __proto__ is special in JavaScript—it's an accessor to the object's prototype. When target["__proto__"] = source["__proto__"] executes, it doesn't create a new property; instead, it modifies the prototype chain itself. Any subsequent object created in the application would inherit the poisoned httpAgent and httpsAgent properties, allowing the attacker to inject custom HTTP agents that could intercept, log, or modify all HTTP traffic.

The Real-World Attack Scenario

Consider this attack against the admin panel:

1. Attacker sends a crafted request to an API endpoint that accepts configuration parameters
2. Malicious payload contains: {"__proto__": {"httpAgent": <attacker's proxy agent>}}
3. axios merges this config unsafely, polluting Object.prototype
4. All subsequent HTTP requests from the admin panel use the attacker's custom agent
5. Result: The attacker intercepts authentication tokens, API responses, or sensitive data transmitted by the admin panel

This is particularly dangerous because:
- The admin panel makes authenticated requests to backend services
- Those requests contain authorization headers and sensitive data
- A compromised HTTP agent could log credentials or modify responses
- The pollution persists across multiple requests and potentially across the application's lifetime

The Vulnerability in Context

The admin panel's package.json specified:

"axios": "^1.15.0"

This version was pulled during dependency installation and locked in package-lock.json:

"node_modules/axios": {
  "version": "1.15.0",
  "resolved": "https://registry.npmmirror.com/axios/-/axios-1.15.0.tgz",
  "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
  "dependencies": {
    "follow-redirects": "^1.15.11"
  }
}

Trivy's security scanner flagged this version as vulnerable to CVE-2026-42033, correctly identifying that the admin panel's HTTP requests could be hijacked through prototype pollution.

The Fix Applied

The fix involved upgrading axios to version 1.15.1, which includes hardened object merging logic:

Before (package.json):

"axios": "^1.15.0"

After (package.json):

"axios": "^1.15.1"

Before (package-lock.json):

"node_modules/axios": {
  "version": "1.15.0",
  "resolved": "https://registry.npmmirror.com/axios/-/axios-1.15.0.tgz",
  "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q=="
}

After (package-lock.json):

"node_modules/axios": {
  "version": "1.15.1",
  "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.1.tgz",
  "integrity": "sha512-WOG+Jj8ZOvR0a3rAn+Tuf1UQJRxw5venr6DgdbJzngJE3qG7X0kL83CZGpdHMxEm+ZK3seAbvFsw4FfOfP9vxg=="
}

What Changed in axios 1.15.1?

The patched version includes a security fix that prevents prototype pollution through several mechanisms:

1. Explicit property whitelisting: Only known, safe configuration properties are merged
2. Prototype pollution guards: Checks that reject __proto__, constructor, and prototype as configuration keys
3. Safe object merging: Uses Object.create(null) or similar patterns to avoid prototype chain traversal
4. Sanitized agent configuration: HTTP/HTTPS agents are validated before assignment

The fix ensures that even if an attacker passes malicious configuration with prototype-polluting payloads, axios will either reject it or safely ignore the dangerous properties without modifying the global prototype chain.

Why Both Files Changed

Both package.json and package-lock.json were updated:

• package.json: Updated the version constraint from ^1.15.0 to ^1.15.1 to specify the minimum safe version
• package-lock.json: Updated with the exact resolved version, integrity hash, and registry URL for reproducible builds

The integrity hash changed from sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q== to sha512-WOG+Jj8ZOvR0a3rAn+Tuf1UQJRxw5venr6DgdbJzngJE3qG7X0kL83CZGpdHMxEm+ZK3seAbvFsw4FfOfP9vxg==, confirming that the package contents changed with the security patch.

Prevention & Best Practices

To avoid prototype pollution vulnerabilities in your Node.js applications:

1. Keep dependencies updated: Regularly run npm audit and update vulnerable packages
   bash npm audit npm audit fix npm update

2. Use safe object merging patterns:
   ```javascript
   // ❌ UNSAFE: Direct property assignment
   function unsafeMerge(target, source) {
   for (const key in source) {
   target[key] = source[key];
   }
   }

// ✅ SAFE: Whitelist allowed properties
function safeMerge(target, source) {
const ALLOWED_KEYS = ['timeout', 'headers', 'method'];
for (const key of ALLOWED_KEYS) {
if (key in source) {
target[key] = source[key];
}
}
}

// ✅ SAFE: Reject dangerous properties
function safeMergeWithGuards(target, source) {
const DANGEROUS_KEYS = ['proto', 'constructor', 'prototype'];
for (const key in source) {
if (!DANGEROUS_KEYS.includes(key)) {
target[key] = source[key];
}
}
}
```

1. Validate configuration objects: Use schema validation libraries like joi or zod to ensure configuration matches expected structure
   ```javascript
   const configSchema = z.object({
   timeout: z.number().optional(),
   headers: z.record(z.string()).optional(),
   method: z.enum(['GET', 'POST', 'PUT', 'DELETE']).optional()
   });

const validConfig = configSchema.parse(userProvidedConfig);
```

1. Use static analysis tools: Tools like Semgrep can detect prototype pollution patterns
   bash semgrep --config p/owasp-top-ten admin-panel/

2. Enable npm security audits in CI/CD: Prevent vulnerable dependencies from reaching production
   yaml - run: npm audit --audit-level=moderate

Key Takeaways

• Prototype pollution in axios 1.15.0 allowed attackers to hijack HTTP transport configuration through unsafe object merging, potentially intercepting all admin panel requests
• The __proto__ accessor is dangerous in object merging operations—never directly assign user-controlled values to prototype-related properties
• Upgrading to axios 1.15.1 patches the vulnerability with hardened object merging that prevents prototype chain traversal
• Both package.json and package-lock.json must be updated to ensure consistent, reproducible builds with the security patch
• Static analysis tools like Trivy correctly identified this vulnerability, demonstrating the value of automated security scanning in CI/CD pipelines

How Orbis AppSec Detected This

• Source: Dependency specification in admin-panel/package.json and admin-panel/package-lock.json referencing axios 1.15.0
• Sink: axios HTTP transport configuration merging logic that handles user-controlled request configuration objects
• Missing control: Safe property whitelisting and prototype pollution guards in object merging operations
• CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and CWE-94 (Improper Control of Generation of Code)
• Fix: Upgrade axios to version 1.15.1, which includes hardened object merging that prevents prototype chain pollution and validates HTTP transport configuration

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

Prototype pollution vulnerabilities in HTTP client libraries pose a significant risk to Node.js applications, especially in components like admin panels that handle sensitive operations and authentication. CVE-2026-42033 demonstrated how unsafe object merging in axios could enable attackers to hijack HTTP transport configuration and intercept application traffic.

By upgrading to axios 1.15.1, the admin panel now benefits from hardened object merging logic that prevents prototype chain pollution. This fix, combined with regular dependency updates and security scanning, significantly reduces the attack surface for HTTP-based vulnerabilities.

Key actions for your team:
1. Run npm audit to identify vulnerable dependencies
2. Review your HTTP client configuration handling for unsafe merging patterns
3. Implement schema validation for all configuration objects
4. Integrate security scanning into your CI/CD pipeline
5. Keep dependencies updated regularly

Secure coding practices and proactive vulnerability management are essential for maintaining a robust security posture in production applications.

References

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
• CWE-94: Improper Control of Generation of Code ('Code Injection')
• OWASP Prototype Pollution
• npm audit documentation
• Semgrep Prototype Pollution Rules
• axios Security Advisories
• GitHub PR: fix: upgrade axios to 1.15.1, 0.31.1 (CVE-2026-42033)