fix(security): defense-in-depth against already-polluted Object.prototype in formDataToJSON by tommyhgunz14 · Pull Request #7413 · axios/axios

tommyhgunz14 · 2026-02-18T20:09:17Z

Summary
Replace the falsy check with hasOwnProp in the intermediate-path branch of formDataToJSON's buildPath to prevent write-through into inherited objects.

Problem
If Object.prototype is already polluted (e.g. via a third-party library or an earlier vulnerability), user-supplied FormData paths like injected.hijack can traverse the inherited object and mutate Object.prototype in place. The original check:

if (!target[name] || !utils.isObject(target[name]))
follows the prototype chain — so if Object.prototype.injected exists and is truthy/an object, the code walks into it and writes there.

Fix
if (!utils.hasOwnProp(target, name) || !utils.isObject(target[name]))
With hasOwnProp, the inherited slot is shadowed by a new own property on the result object, keeping writes local. No prototype mutation occurs.

Context
This is defense-in-depth, not a standalone CVE fix. The existing proto guard blocks direct prototype injection; this change prevents exploitation of an already-polluted prototype chain. It does not claim to fix constructor.prototype pollution — that path was already handled by the existing CVE test.

Test
Added a write-through regression test that:

Manually pollutes Object.prototype.injected = { hijack: true }
Sends injected.hijack=STOLEN through formDataToJSON
Asserts the result gets its own { hijack: 'STOLEN' } (not appended to the inherited object)
Asserts Object.prototype.injected.hijack remains true (unmutated)
The test fails on unpatched HEAD and passes with the one-line change.

Closes #7209

cubic-dev-ai

No issues found across 2 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

tommyhgunz14 · 2026-03-22T10:17:42Z

Hi - this has been outstanding for a while now, should still be good.

jasonsaayman · 2026-03-23T06:10:55Z

Hi - this has been outstanding for a while now, should still be good.

thanks i will check this out asap

tommyhgunz14 · 2026-04-28T15:00:33Z

@jasonsaayman I dont think there is anything outstanding on this for me? Didnt hear back from your last comment

jasonsaayman · 2026-04-28T15:21:38Z

Thanks for the patch. The code change is the right pattern and worth landing, but a couple of things need fixing before it can go in, and the framing around what it actually fixes needs to change too.

I traced and reproduced both the claimed and actual behaviour against the current v1.x HEAD.

The description says this prevents pollution via constructor.prototype chains. That isn't quite accurate — the existing code already handles that case, because target.constructor returns the function Object, which fails utils.isObject (functions don't pass the typeof === 'object' check), so the slot already gets reset to []. Demonstrated against unpatched HEAD:

input:  constructor.prototype.polluted = 'true'
result: {"constructor":{"prototype":{"polluted":"true"}},"safe":"data"}
{}.polluted === undefined
Object.prototype.polluted === undefined

The new test passes against unpatched code too, so it isn't covering the path your change affects.

The real benefit of the change is defence-in-depth against an already-polluted runtime. If something else has set Object.prototype.injected = { hijack: true }, the unpatched code traverses the prototype chain, calls isObject, and writes the user's value into Object.prototype:

without PR:
  result: {}
  Object.prototype.injected.hijack === [true, "STOLEN"]   // mutated through

with PR:
  result: {"injected":{"hijack":"STOLEN"}}
  Object.prototype.injected.hijack === true               // intact

That's the scenario these guards face, and that's what the test should cover.

A few more things to fix:

The test path is wrong. The PR adds tests at test/specs/helpers/formDataToJSON.spec.js. The repo runs Vitest from tests/unit/helpers/formDataToJSON.test.js; package.json only defines test:vitest. The new test won't run in CI.
The test duplicates existing coverage. tests/unit/helpers/formDataToJSON.test.js:78 already has a should resist prototype pollution CVE block that exercises constructor.prototype.y and asserts {}.y === undefined. The added test is essentially the same, with renamed keys.
Suggested replacement test that actually exercises the guard:

it('should not write through to inherited objects on Object.prototype', () => {
  Object.prototype.injected = { hijack: true };
  try {
    const formData = new FormData();
    formData.append('injected.hijack', 'STOLEN');
    const result = formDataToJSON(formData);

    expect(result.injected).toEqual({ hijack: 'STOLEN' });
    expect(Object.prototype.injected.hijack).toEqual(true);
  } finally {
    delete Object.prototype.injected;
  }
});

This would fail against the current HEAD and pass with your one-line change applied.

Could you fold the fix into tests/unit/helpers/formDataToJSON.test.js, drop the duplicate test, and add the inherited-object write-through case? Once that's in, the code change itself is a clean defence-in-depth improvement.

Replace falsy check with hasOwnProp in the intermediate-path branch of formDataToJSON's buildPath to prevent write-through into inherited objects. Without this patch, if Object.prototype is already polluted (e.g. via a third-party library or earlier vulnerability), user-supplied FormData paths like 'injected.hijack' traverse the inherited object and mutate Object.prototype in place. With hasOwnProp, the inherited slot is shadowed by a new own property, keeping writes local to the result. This is defense-in-depth: the existing __proto__ guard blocks direct prototype injection, while this change prevents exploitation of an already-polluted prototype chain. Closes axios#7209

tommyhgunz14 · 2026-04-30T16:19:18Z

Hi - thanks for the detailed feedback. Please see below -

Updated:

Rebased onto current v1.x (was 164 commits behind). Branch is now up to date with the test/ → tests/ migration and Vitest.
Dropped the duplicate test that was essentially re-testing constructor.prototype (already covered by the existing CVE test).
Added the write-through regression test you suggested — pollutes Object.prototype.injected, sends injected.hijack through formDataToJSON, and asserts the inherited object isn't mutated. Confirmed it fails on unpatched HEAD and passes with the fix.
Corrected framing: this is defense-in-depth against an already-polluted Object.prototype, not a standalone constructor.prototype fix.
Test file is now in tests/unit/helpers/formDataToJSON.test.js (no leftover under old test/specs/).

…ession test

https://app.devrev.ai/devrev/issue/ASCPT-41 ![snyk-top-banner](https://res.cloudinary.com/snyk/image/upload/r-d/scm-platform/snyk-pull-requests/pr-banner-default.svg) <h3>Snyk has created this PR to upgrade axios from 1.16.1 to 1.17.0.</h3> :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project. <hr/> - The recommended version is **1 version** ahead of your current version. - The recommended version was released **22 days ago**. <details> <summary>Release notes</summary> <details> <summary>Package name: axios</summary> <ul> <li> 1.17.0 - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.17.0">2026-06-03</a><h2>v1.17.0 — June 1, 2026</h2> This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions. <h2>🔒 Security Fixes</h2> <ul> <li>Config Hardening: Guarded <code>socketPath</code>, <code>params</code>, and <code>paramsSerializer</code> reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a>)</li> <li>Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496414139" data-permission-text="Title is private" data-url="axios/axios#10926" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10926/hovercard" href="https://redirect.github.com/axios/axios/pull/10926">#10926</a>)</li> </ul> <h2>🚀 New Features</h2> <ul> <li>HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with <code>transitional.advertiseZstdAcceptEncoding</code> controlling whether <code>zstd</code> is advertised in <code>Accept-Encoding</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488098721" data-permission-text="Title is private" data-url="axios/axios#10920" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10920/hovercard" href="https://redirect.github.com/axios/axios/pull/10920">#10920</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a>)</li> <li>Proxy TLS: Preserved user <code>httpsAgent</code> TLS options when tunneling HTTPS requests through HTTP CONNECT proxies. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542876807" data-permission-text="Title is private" data-url="axios/axios#10957" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10957/hovercard" href="https://redirect.github.com/axios/axios/pull/10957">#10957</a>)</li> <li>React Native FormData: Cleared default <code>Content-Type</code> for React Native <code>FormData</code> so multipart boundaries can be generated correctly. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4460351681" data-permission-text="Title is private" data-url="axios/axios#10898" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10898/hovercard" href="https://redirect.github.com/axios/axios/pull/10898">#10898</a>)</li> <li>Headers: Silently skipped empty or whitespace-only header names instead of throwing, matching parsed-header behavior and avoiding React Native response crashes. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414924447" data-permission-text="Title is private" data-url="axios/axios#10875" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10875/hovercard" href="https://redirect.github.com/axios/axios/pull/10875">#10875</a>)</li> <li>Request Data Merging: Preserved enumerable symbol keys when cloning plain request data through axios merge logic. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a>)</li> <li>Bundler Compatibility: Converted <code>resolveConfig</code> from an arrow default export to a named function export to avoid webpack and Babel transform interop failures. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a>)</li> <li>Types: Corrected <code>AxiosHeaders.toJSON()</code> return types and updated CommonJS <code>isCancel</code> typings to narrow to <code>CanceledError<T></code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4541388760" data-permission-text="Title is private" data-url="axios/axios#10956" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10956/hovercard" href="https://redirect.github.com/axios/axios/pull/10956">#10956</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4534902166" data-permission-text="Title is private" data-url="axios/axios#10952" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10952/hovercard" href="https://redirect.github.com/axios/axios/pull/10952">#10952</a>)</li> <li>Build Tooling: Avoided emitting a null <code>Authorization</code> header from the GitHub build helper when <code>GITHUB_TOKEN</code> is unset. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>HTTP/2 Internals: Extracted <code>Http2Sessions</code> into its own helper module and added direct unit coverage for session pooling, timeout, and cleanup behavior. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a>)</li> <li>Package Publishing: Reduced published package size by switching to a <code>files</code> allowlist and dropping unneeded unminified bundle source maps. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a>)</li> <li>CI and Release Automation: Added bundle-size reporting, moved reports to the job summary, fixed bundle-size comparison coverage, added Node 26 to the matrix, pinned npm for staged publishing, and prepared the 1.17.0 release. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471484133" data-permission-text="Title is private" data-url="axios/axios#10907" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10907/hovercard" href="https://redirect.github.com/axios/axios/pull/10907">#10907</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4477353252" data-permission-text="Title is private" data-url="axios/axios#10911" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10911/hovercard" href="https://redirect.github.com/axios/axios/pull/10911">#10911</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479841599" data-permission-text="Title is private" data-url="axios/axios#10916" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10916/hovercard" href="https://redirect.github.com/axios/axios/pull/10916">#10916</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496500463" data-permission-text="Title is private" data-url="axios/axios#10927" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10927/hovercard" href="https://redirect.github.com/axios/axios/pull/10927">#10927</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506636815" data-permission-text="Title is private" data-url="axios/axios#10935" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10935/hovercard" href="https://redirect.github.com/axios/axios/pull/10935">#10935</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4564803325" data-permission-text="Title is private" data-url="axios/axios#10983" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10983/hovercard" href="https://redirect.github.com/axios/axios/pull/10983">#10983</a>)</li> <li>Developer Workflow: Added a dev container and iterated on OpenSpec workflow files before removing them from the release branch. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4496362243" data-permission-text="Title is private" data-url="axios/axios#10925" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10925/hovercard" href="https://redirect.github.com/axios/axios/pull/10925">#10925</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479754974" data-permission-text="Title is private" data-url="axios/axios#10914" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10914/hovercard" href="https://redirect.github.com/axios/axios/pull/10914">#10914</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4542923609" data-permission-text="Title is private" data-url="axios/axios#10958" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10958/hovercard" href="https://redirect.github.com/axios/axios/pull/10958">#10958</a>)</li> <li>Documentation and Policy: Updated disclosure, contributor, collaboration, threat-model, advanced docs, README badges, release notes, moderator configuration, and project metadata. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439857559" data-permission-text="Title is private" data-url="axios/axios#10890" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10890/hovercard" href="https://redirect.github.com/axios/axios/pull/10890">#10890</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439812615" data-permission-text="Title is private" data-url="axios/axios#10889" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10889/hovercard" href="https://redirect.github.com/axios/axios/pull/10889">#10889</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4488493808" data-permission-text="Title is private" data-url="axios/axios#10921" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10921/hovercard" href="https://redirect.github.com/axios/axios/pull/10921">#10921</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4521919780" data-permission-text="Title is private" data-url="axios/axios#10945" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10945/hovercard" href="https://redirect.github.com/axios/axios/pull/10945">#10945</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504485021" data-permission-text="Title is private" data-url="axios/axios#10933" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10933/hovercard" href="https://redirect.github.com/axios/axios/pull/10933">#10933</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4479794362" data-permission-text="Title is private" data-url="axios/axios#10915" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10915/hovercard" href="https://redirect.github.com/axios/axios/pull/10915">#10915</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4439585604" data-permission-text="Title is private" data-url="axios/axios#10887" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10887/hovercard" href="https://redirect.github.com/axios/axios/pull/10887">#10887</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4539242124" data-permission-text="Title is private" data-url="axios/axios#10955" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10955/hovercard" href="https://redirect.github.com/axios/axios/pull/10955">#10955</a>)</li> <li>Dependencies: Bumped Babel tooling, Commitlint, ESLint, Rollup, Globals, Vitest, Playwright, <code>fs-extra</code>, <code>qs</code>, docs dependencies, and GitHub Actions dependencies including <code>actions/dependency-review-action</code> and <code>zizmorcore/zizmor-action</code>. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4413298372" data-permission-text="Title is private" data-url="axios/axios#10871" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10871/hovercard" href="https://redirect.github.com/axios/axios/pull/10871">#10871</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4430775028" data-permission-text="Title is private" data-url="axios/axios#10879" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10879/hovercard" href="https://redirect.github.com/axios/axios/pull/10879">#10879</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481451976" data-permission-text="Title is private" data-url="axios/axios#10918" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10918/hovercard" href="https://redirect.github.com/axios/axios/pull/10918">#10918</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4481452562" data-permission-text="Title is private" data-url="axios/axios#10919" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10919/hovercard" href="https://redirect.github.com/axios/axios/pull/10919">#10919</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4504986865" data-permission-text="Title is private" data-url="axios/axios#10934" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10934/hovercard" href="https://redirect.github.com/axios/axios/pull/10934">#10934</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4526297030" data-permission-text="Title is private" data-url="axios/axios#10947" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10947/hovercard" href="https://redirect.github.com/axios/axios/pull/10947">#10947</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4537480721" data-permission-text="Title is private" data-url="axios/axios#10954" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10954/hovercard" href="https://redirect.github.com/axios/axios/pull/10954">#10954</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4549771364" data-permission-text="Title is private" data-url="axios/axios#10960" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10960/hovercard" href="https://redirect.github.com/axios/axios/pull/10960">#10960</a>)</li> </ul> <h2>🌟 New Contributors</h2> We are thrilled to welcome our new contributors. Thank you for helping improve axios: <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/BasixKOR/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/BasixKOR">@ BasixKOR</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="2873194565" data-permission-text="Title is private" data-url="axios/axios#6792" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/6792/hovercard" href="https://redirect.github.com/axios/axios/pull/6792">#6792</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/carladams1299-lab/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/carladams1299-lab">@ carladams1299-lab</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4395016914" data-permission-text="Title is private" data-url="axios/axios#10861" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10861/hovercard" href="https://redirect.github.com/axios/axios/pull/10861">#10861</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/LaplaceYoung/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/LaplaceYoung">@ LaplaceYoung</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4340876537" data-permission-text="Title is private" data-url="axios/axios#10812" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10812/hovercard" href="https://redirect.github.com/axios/axios/pull/10812">#10812</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/JamieMagee/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/JamieMagee">@ JamieMagee</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4506840788" data-permission-text="Title is private" data-url="axios/axios#10939" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10939/hovercard" href="https://redirect.github.com/axios/axios/pull/10939">#10939</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/RonGamzu/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/RonGamzu">@ RonGamzu</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4471392208" data-permission-text="Title is private" data-url="axios/axios#10905" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10905/hovercard" href="https://redirect.github.com/axios/axios/pull/10905">#10905</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sapirbaruch/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sapirbaruch">@ sapirbaruch</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4444501376" data-permission-text="Title is private" data-url="axios/axios#10891" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10891/hovercard" href="https://redirect.github.com/axios/axios/pull/10891">#10891</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/nezukoagent/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/nezukoagent">@ nezukoagent</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4463370380" data-permission-text="Title is private" data-url="axios/axios#10901" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10901/hovercard" href="https://redirect.github.com/axios/axios/pull/10901">#10901</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/devareddy05/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/devareddy05">@ devareddy05</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497340497" data-permission-text="Title is private" data-url="axios/axios#10929" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10929/hovercard" href="https://redirect.github.com/axios/axios/pull/10929">#10929</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Mohammad-Faiz-Cloud-Engineer/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Mohammad-Faiz-Cloud-Engineer">@ Mohammad-Faiz-Cloud-Engineer</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4490479466" data-permission-text="Title is private" data-url="axios/axios#10922" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10922/hovercard" href="https://redirect.github.com/axios/axios/pull/10922">#10922</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/azandabot/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/azandabot">@ azandabot</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4497546091" data-permission-text="Title is private" data-url="axios/axios#10931" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10931/hovercard" href="https://redirect.github.com/axios/axios/pull/10931">#10931</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/niksy/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/niksy">@ niksy</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4452495512" data-permission-text="Title is private" data-url="axios/axios#10896" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10896/hovercard" href="https://redirect.github.com/axios/axios/pull/10896">#10896</a>)</li> </ul> <a href="https://redirect.github.com/axios/axios/compare/v1.16.1...v1.17.0">Full Changelog</a> </li> <li> 1.16.1 - <a href="https://redirect.github.com/axios/axios/releases/tag/v1.16.1">2026-05-13</a><h2>v1.16.1 — May 13, 2026</h2> This release ships a defence-in-depth fix for prototype pollution in <code>formDataToJSON</code>, hardens proxy and CI workflows, restores Webpack 4 compatibility for the fetch adapter, and includes several small bug fixes and maintenance improvements. <h2>🔒 Security Fixes</h2> <ul> <li>Prototype Pollution Defence-in-Depth: Hardened <code>formDataToJSON</code> against already-polluted <code>Object.prototype</code> by walking own properties only, so attacker-controlled keys inherited from a poisoned prototype cannot propagate through deserialization. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a>)</li> <li>Proxy Cleartext Leak: Fixed an issue where HTTPS request data could be transmitted in cleartext to an HTTP proxy under certain configurations. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392783718" data-permission-text="Title is private" data-url="axios/axios#10858" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10858/hovercard" href="https://redirect.github.com/axios/axios/pull/10858">#10858</a>)</li> <li>CI Cache Removal: Removed all GitHub Actions caches as a defence-in-depth measure against cache poisoning vectors in the build pipeline. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4431484006" data-permission-text="Title is private" data-url="axios/axios#10882" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10882/hovercard" href="https://redirect.github.com/axios/axios/pull/10882">#10882</a>)</li> </ul> <h2>🐛 Bug Fixes</h2> <ul> <li>Data URI Parsing: Updated the <code>fromDataURI</code> regex to match RFC 2397 more strictly, fixing edge cases in <code>data:</code> URL handling. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a>)</li> <li>Unicode Headers: Preserved Unicode header values when running through request interceptors, so non-ASCII header content is no longer corrupted before dispatch. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4388506485" data-permission-text="Title is private" data-url="axios/axios#10850" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10850/hovercard" href="https://redirect.github.com/axios/axios/pull/10850">#10850</a>)</li> <li>XHR Upload Progress: Guarded against malformed <code>ProgressEvent</code> payloads emitted by some environments during XHR upload, preventing crashes when <code>loaded</code> / <code>total</code> are missing or invalid. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a>)</li> <li>Webpack 4 Fetch Adapter: Fixed an "unexpected token" error caused by syntax in the fetch adapter that Webpack 4 could not parse, restoring compatibility for legacy bundler users. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4400660060" data-permission-text="Title is private" data-url="axios/axios#10864" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10864/hovercard" href="https://redirect.github.com/axios/axios/pull/10864">#10864</a>)</li> <li>Type Definitions: Made <code>parseReviver</code> <code>context.source</code> optional in the type definitions to align with the ES2023 specification. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4370232960" data-permission-text="Title is private" data-url="axios/axios#10837" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10837/hovercard" href="https://redirect.github.com/axios/axios/pull/10837">#10837</a>)</li> <li>URL Object Support Reverted: Reverted the change that allowed passing a <code>URL</code> object as <code>config.url</code> (originally <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a>) due to regressions; this support will be reintroduced in a later release once the underlying issues are addressed. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4414921751" data-permission-text="Title is private" data-url="axios/axios#10874" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10874/hovercard" href="https://redirect.github.com/axios/axios/pull/10874">#10874</a>)</li> </ul> <h2>🔧 Maintenance & Chores</h2> <ul> <li>Cycle Detection Refactor: Replaced the array-based cycle tracker in <code>toJSONObject</code> with a <code>WeakSet</code>, improving performance and memory behaviour on large nested structures. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4361368446" data-permission-text="Title is private" data-url="axios/axios#10832" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10832/hovercard" href="https://redirect.github.com/axios/axios/pull/10832">#10832</a>)</li> <li>composeSignals Cleanup: Refactored <code>composeSignals</code> to use a clearer early-return structure, simplifying the cancellation/abort composition path. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4380190238" data-permission-text="Title is private" data-url="axios/axios#10844" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10844/hovercard" href="https://redirect.github.com/axios/axios/pull/10844">#10844</a>)</li> <li>AI Readiness & Repo Docs: Added <code>AGENTS.md</code> and related contributor-guide updates for both human and AI agents, plus post-release documentation improvements. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369274702" data-permission-text="Title is private" data-url="axios/axios#10835" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10835/hovercard" href="https://redirect.github.com/axios/axios/pull/10835">#10835</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378451451" data-permission-text="Title is private" data-url="axios/axios#10841" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10841/hovercard" href="https://redirect.github.com/axios/axios/pull/10841">#10841</a>)</li> <li>Docs Improvements: Clarified the GET request example, fixed the interceptor <code>eject</code> example to reference the correct instance, and corrected the Buzzoid sponsor description in the README. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a>)</li> <li>Sponsorship Tooling: Fixed empty sponsor arrays in the sponsor processing script, added the ability to inject additional sponsors, updated the sponsorship link, and added a Twicsy advertisement entry. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4378946632" data-permission-text="Title is private" data-url="axios/axios#10843" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10843/hovercard" href="https://redirect.github.com/axios/axios/pull/10843">#10843</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4393416912" data-permission-text="Title is private" data-url="axios/axios#10859" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10859/hovercard" href="https://redirect.github.com/axios/axios/pull/10859">#10859</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4412918174" data-permission-text="Title is private" data-url="axios/axios#10869" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10869/hovercard" href="https://redirect.github.com/axios/axios/pull/10869">#10869</a>)</li> <li>Dependencies: Bumped <code>@ commitlint/cli</code> from 20.5.0 to 20.5.2. (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4383276255" data-permission-text="Title is private" data-url="axios/axios#10846" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10846/hovercard" href="https://redirect.github.com/axios/axios/pull/10846">#10846</a>)</li> </ul> <h2>🌟 New Contributors</h2> We are thrilled to welcome our new contributors. Thank you for helping improve axios: <ul> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/hpinmetaverse/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/hpinmetaverse">@ hpinmetaverse</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4369287222" data-permission-text="Title is private" data-url="axios/axios#10836" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10836/hovercard" href="https://redirect.github.com/axios/axios/pull/10836">#10836</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tommyhgunz14/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/tommyhgunz14">@ tommyhgunz14</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="3959581677" data-permission-text="Title is private" data-url="axios/axios#7413" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/7413/hovercard" href="https://redirect.github.com/axios/axios/pull/7413">#7413</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/abhu85/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/abhu85">@ abhu85</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4356424237" data-permission-text="Title is private" data-url="axios/axios#10829" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10829/hovercard" href="https://redirect.github.com/axios/axios/pull/10829">#10829</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/divyanshuraj1095/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/divyanshuraj1095">@ divyanshuraj1095</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4390162698" data-permission-text="Title is private" data-url="axios/axios#10853" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10853/hovercard" href="https://redirect.github.com/axios/axios/pull/10853">#10853</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/sagodi97/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/sagodi97">@ sagodi97</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4392363280" data-permission-text="Title is private" data-url="axios/axios#10856" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10856/hovercard" href="https://redirect.github.com/axios/axios/pull/10856">#10856</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rkdfx/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/rkdfx">@ rkdfx</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4409815240" data-permission-text="Title is private" data-url="axios/axios#10868" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10868/hovercard" href="https://redirect.github.com/axios/axios/pull/10868">#10868</a>)</li> <li><a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Liuwei1125/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://redirect.github.com/Liuwei1125">@ Liuwei1125</a> (<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="4403806527" data-permission-text="Title is private" data-url="axios/axios#10866" data-hovercard-type="pull_request" data-hovercard-url="/axios/axios/pull/10866/hovercard" href="https://redirect.github.com/axios/axios/pull/10866">#10866</a>)</li> </ul> <a href="https://redirect.github.com/axios/axios/compare/v1.16.0...v1.16.1">Full Changelog</a> </li> </ul> from <a href="https://redirect.github.com/axios/axios/releases">axios GitHub release notes</a> </details> </details> --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs._ **For more information:** <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJiZjMyYzAwMC1iZGM2LTQyMzktYjg1Mi0wMzRhOGNhYTIzZDUiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImJmMzJjMDAwLWJkYzYtNDIzOS1iODUyLTAzNGE4Y2FhMjNkNSJ9fQ==" width="0" height="0"/> > - 🧐 [View latest project report](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates?utm_source=&utm_content=fix-pr-template) > - 🛠 [Adjust upgrade PR settings](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?utm_source=github&utm_medium=referral&page=upgrade-pr) > - 🔕 [Ignore this dependency or unsubscribe from future upgrade PRs](https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2/settings/integration?pkg=axios&utm_source=github&utm_medium=referral&page=upgrade-pr#auto-dep-upgrades) [//]: # 'snyk:metadata:{"breakingChangeRiskLevel":null,"FF_showPullRequestBreakingChanges":false,"FF_showPullRequestBreakingChangesWebSearch":false,"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"axios","from":"1.16.1","to":"1.17.0"}],"env":"prod","hasFixes":false,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[],"prId":"bf32c000-bdc6-4239-b852-034a8caa23d5","prPublicId":"bf32c000-bdc6-4239-b852-034a8caa23d5","packageManager":"npm","priorityScoreList":[],"projectPublicId":"58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2","projectUrl":"https://app.snyk.io/org/devrev/project/58ce53c3-7bbd-4cc5-bc81-52dc7ce644c2?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":[],"type":"auto","upgrade":[],"upgradeInfo":{"versionsDiff":1,"publishedDate":"2026-06-03T06:58:28.145Z"},"vulns":[]}' Co-authored-by: snyk-bot <[email protected]>

cubic-dev-ai Bot reviewed Feb 18, 2026

View reviewed changes

tommyhgunz14 force-pushed the fix/extend-prototype-pollution-protection branch from 17122a4 to 2f78311 Compare March 23, 2026 12:47

jasonsaayman assigned tommyhgunz14 Apr 29, 2026

jasonsaayman added priority::medium status::changes-requested A reviewer requested changes to the PR status::needs-rebase The PR requires a rebase labels Apr 29, 2026

tommyhgunz14 force-pushed the fix/extend-prototype-pollution-protection branch from 2f78311 to aa3b45a Compare April 30, 2026 16:13

tommyhgunz14 requested a review from jasonsaayman as a code owner April 30, 2026 16:13

tommyhgunz14 changed the title ~~fix(security): extend prototype pollution protection in formDataToJSON~~ fix(security): defense-in-depth against already-polluted Object.prototype in formDataToJSON Apr 30, 2026

jasonsaayman added 2 commits May 1, 2026 19:24

Merge branch 'v1.x' into fix/extend-prototype-pollution-protection

e4eeb4c

test(security): use defineProperty + toBe in prototype-pollution regr…

199d40b

…ession test

jasonsaayman approved these changes May 1, 2026

View reviewed changes

Merge branch 'v1.x' into fix/extend-prototype-pollution-protection

6b6672a

jasonsaayman merged commit 78e8dcf into axios:v1.x May 4, 2026
23 checks passed

github-actions Bot mentioned this pull request May 5, 2026

[Vulnerability] axios/axios: Prototype Pollution 7azimo01/vulnerability-spoiler-alert#433

Open

github-actions Bot mentioned this pull request Jul 20, 2026

Security vulnerabilities (automated scan) dam-agents/dam#2737

Open

This was referenced Jul 22, 2026

GHSA-xj6q-8x83-jv6g (MEDIUM): detected in Lambda Docker Images. aws/aws-lambda-base-images#625

Open

GHSA-xj6q-8x83-jv6g (MEDIUM): detected in Lambda Docker Images. the-lambda-watchdog/AWS-Lambda-Security-Reports#332

Open

This was referenced Jul 23, 2026

chore(deps): update bruno to v3.5.3 uniget-org/tools#24342

Merged

chore(deps): update bruno to v4 uniget-org/tools#24383

Merged

graviteeio mentioned this pull request Jul 24, 2026

[4.10.x] chore: bump @gravitee/ui-components to 4.5.2 gravitee-io/gravitee-api-management#18736

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(security): defense-in-depth against already-polluted Object.prototype in formDataToJSON#7413

fix(security): defense-in-depth against already-polluted Object.prototype in formDataToJSON#7413
jasonsaayman merged 4 commits into
axios:v1.xfrom
tommyhgunz14:fix/extend-prototype-pollution-protection

tommyhgunz14 commented Feb 18, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

tommyhgunz14 commented Mar 22, 2026

Uh oh!

jasonsaayman commented Mar 23, 2026

Uh oh!

tommyhgunz14 commented Apr 28, 2026

Uh oh!

jasonsaayman commented Apr 28, 2026 •

edited

Loading

Uh oh!

tommyhgunz14 commented Apr 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

tommyhgunz14 commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

tommyhgunz14 commented Mar 22, 2026

Uh oh!

jasonsaayman commented Mar 23, 2026

Uh oh!

tommyhgunz14 commented Apr 28, 2026

Uh oh!

jasonsaayman commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tommyhgunz14 commented Apr 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tommyhgunz14 commented Feb 18, 2026 •

edited

Loading

jasonsaayman commented Apr 28, 2026 •

edited

Loading