Axios Security Patches: CRLF Injection, Prototype Pollution, and Arbitrary File Upload Fixes

Axios Security Vulnerability Summary Vulnerability Overview This webpage screenshot displays multiple security patch submissions for the Axios library, primarily addressing the following vulnerabilities: 1. Header Injection (CRLF): Rejects header values containing or characters to prevent CRLF injection attacks. 2. Prototype Pollution: Ignores , , and keys within to prevent denial of service (DoS) attacks caused by prototype pollution. 3. Formidable Vulnerability: Upgrades the library to fix an arbitrary file upload vulnerability. 4. Prototype Pollution in : Adds input validation to prevent prototype pollution resulting from malicious or unintended input. Impact Scope Header Injection (CRLF): Affects all applications using Axios to send HTTP requests, particularly those allowing user-controlled header values. Prototype Pollution: Affects all applications using Axios to merge configurations, particularly those allowing user-controlled configuration objects. Formidable Vulnerability: Affects all applications using Axios to handle file uploads. Prototype Pollution in : Affects all applications using Axios to process URLs, particularly those allowing user-controlled URLs. Remediation Steps 1. Header Injection (CRLF): - Add validation for header values in , rejecting values containing or . - Example code: 2. Prototype Pollution: - Add filtering for , , and keys in the function within . - Example code: 3. Formidable Vulnerability: - Upgrade the library to the latest version to fix the arbitrary file upload vulnerability. 4. Prototype Pollution in : - Add input validation in the function within to prevent malicious or unintended input. - Example code: Other Fixes Node.js v22 Compatibility: Replaced deprecated calls to eliminate deprecation warnings in Node.js v22. CI Security Hardening: Added GitHub Actions security scanners, restricted publish permissions, and prevented sponsor workflows from running on forks. Documentation Updates: Clarified documentation regarding HTTP/2 support and the option; added examples for preserving header casing. Dependency Updates: Updated multiple dependent libraries to their latest versions, including , , and . New Contributors Thanks to the following new contributors for their help: - @Kilr0ss881 - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @NathanMuniz - @Natha

Goal Reached Thanks to every supporter — we hit 100%!

Axios Security Patches: CRLF Injection, Prototype Pollution, and Arbitrary File Upload Fixes

More from this source