The Axios config merge utility now rejects __proto__, constructor, and prototype keys, closing a potential prototype pollution vector.
Evidence
Proto key rejection (search for "__proto__" near "constructor" near "prototype")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.