Fix Denial of Service via __proto__ Key in mergeConfig - #7369

Pull request overview

This pull request addresses a Denial of Service vulnerability via prototype pollution by adding guards against dangerous property keys (proto, constructor, prototype) in the mergeConfig function.

Changes:

• Added checks to skip dangerous property keys that could lead to prototype pollution attacks
• Changed property lookup from direct bracket access to Object.hasOwn() for safer property checking
• Applied code formatting changes (quote style and multi-line formatting)

2 issues found across 1 file

Confidence score: 2/5

• The __proto__ pollution fix in lib/core/mergeConfig.js only guards top-level keys, so nested objects (e.g., inside headers) can still reach utils.merge, which leaves a concrete security/regression risk.
• Using Object.hasOwn in lib/core/mergeConfig.js may crash on older supported Node.js versions (e.g., 14), creating runtime failures in those environments.
• Pay close attention to lib/core/mergeConfig.js - incomplete nested __proto__ protection and potential Node.js compatibility issues.

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="lib/core/mergeConfig.js">

<violation number="1" location="lib/core/mergeConfig.js:103">
P1: The fix for `__proto__` pollution is incomplete because it only checks top-level keys. Nested objects containing `__proto__` (e.g., in `headers`) are passed to `utils.merge` (via `mergeDeepProperties`), which is still vulnerable to prototype pollution. This allows attackers to bypass the fix by nesting the payload.

To fully fix this, `utils.merge` in `lib/utils.js` should be updated to skip `__proto__`, `constructor`, and `prototype` keys during deep merges.</violation>

<violation number="2" location="lib/core/mergeConfig.js:109">
P2: `Object.hasOwn` was added in Node.js 16.9.0 and is not supported in older environments that Axios likely supports (e.g., Node.js 14). Using it without a polyfill will cause crashes in those environments. Consider using `Object.prototype.hasOwnProperty.call` for better compatibility.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}