https://shellvoide.com/blog/blog The Shellvoide security blog: AI-driven penetration testing, vulnerability research, and application security insights from the team behind KLUE. en-us info@shellvoide.com (Shellvoide) info@shellvoide.com (Shellvoide) Fri, 25 Sep 2026 00:00:00 GMT https://shellvoide.com/blog/blog/axios-prototype-pollution-method-gadget https://shellvoide.com/blog/blog/axios-prototype-pollution-method-gadget axios is the HTTP client most JavaScript and Node apps use to make requests. While reading through it, our security agent KLUE found a bug in how axios chooses the request method. On the default axios object, if another flaw in your app has polluted Object.prototype, a call you wrote as a safe GET can quietly go out as a DELETE, POST, PUT, or PATCH. Here is how KLUE found it, why only some ways of calling axios are affected, and how it was fixed. Fri, 25 Sep 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studyvulnerability-researchprototype-pollutiongadgetjavascriptnodejsaxioshttp-clientapi-securityautonomous-securityappsec