GHSA-m8m8-qj5v-23w3: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited

Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection creation. If Object.prototype.createConnection has been polluted elsewhere in the same process, Node can call the inherited function and create a socket to an attacker-controlled endpoint. Axios does not create the prototype pollution source. …