GHSA-7q8q-rj6j-mhjq: Axios: Nested axios option objects can consume polluted prototype values

Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into ordinary objects. If application code passes placeholders such as auth: {} or paramsSerializer: {}, inherited username, password, encode, or serialize properties can influence outbound requests. Impact This is reachable only when another component has already polluted Object.prototype and the application passes an affected nested axios option object. Confirmed impacts include silent injection of an Authorization: Basic ... header from inherited username and password values, and query-string tampering when inherited paramsSerializer fields are function-valued. The auth case requires only string-valued pollution. Full query-string replacement through paramsSerializer.serialize requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through encode. This does not mean every axios request is affected. Requests that do not pass auth, do not pass paramsSerializer, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget. Affected Functionality Affected runtime functionality: - Node HTTP adapter Basic auth handling in lib/adapters/http.js. - Browser/fetch/XHR Basic auth handling through lib/helpers/resolveConfig.js. - Query serialization through lib/helpers/buildURL.js. - axios.getUri() when called with an affected paramsSerializer object. Affected config shapes: - auth: {} or an auth object missing own username and/or password. - paramsSerializer: {} or a paramsSerializer object missing own encode and/or serialize. Unaffected by this specific issue: - Requests with no auth property. - Requests with no paramsSerializer property. - Top-level polluted auth or par