GHSA-7q8q-rj6j-mhjq

## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`. The top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests. ## Impact This is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object. Confirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued. The `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`. This does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget. ## Affected Functionality Affected runtime functionality: - Node HTTP adapter Basic auth handling in `lib/adapters/http.js`. - Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`. - Query serialization through `lib/helpers/buildURL.js`. - `axios.getUri()` when called with an affected `paramsSerializer` object. Affected config shapes: - `auth: {}` or an `auth` object missing own `username` and/or `password`. - `paramsSerializer: {}` or a `paramsSerializer` object missing own `encode` and/or `serialize`. Unaffected by this specific issue: - Requests with no `auth` property. - R