axios CVE-2026-67316

Exploitation requires that Object.prototype has already been polluted by a separate, independently exploitable vulnerability or malicious dependency in the same JavaScript runtime - this is the AT:P precondition in the CVSS 4.0 vector and is the single most important limiting factor. The data gadget affects all callers of axios.get(), axios.delete(), axios.head(), and axios.options() on any axios version below 1.18.0 (1.x) or 0.33.0 (0.x) - no special configuration is required for this specific gadget. The proxy gadget additionally requires direct invocation of axios/lib/adapters/http.js or axios/unsafe/adapters/http.js with a plain config object that has no own proxy property, and does NOT reproduce through normal high-level axios API calls on 1.15.2+. The paramsSerializer gadget requires direct invocation of axios/unsafe/helpers/resolveConfig.js or browser adapter helpers with a plain config having no own paramsSerializer, and also does not reproduce through normal high-level calls on 1.15.2+. Exploitation is limited to environments where a prototype pollution source exists; pure axios deployments with no other vulnerabilities are not exploitable by this gadget alone.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L reflects a genuinely constrained risk profile. The AT:P (Attack Requirements Present) metric is the critical limiting factor: exploitation of this gadget is impossible without a separately exploitable prototype pollution source already present in the application stack. This transforms a theoretical integrity impact (VI:L) into a chained multi-stage attack. The impact is bounded to integrity - injected request bodies on semantically bodyless HTTP methods, or proxy-route hijacking in low-level adapter usage - with no confidentiality or availability impact scored. EPSS data was not provided; given the chained prerequisite nature, real-world exploitation probability should be treated as lower than the raw CVSS score implies. No CISA KEV listing and no confirmed POC further reduce urgency relative to standalone remote code execution vulnerabilities at similar CVSS scores. However, for applications that already have a prototype pollution vulnerability elsewhere (e.g., from a separate npm dependency), this gadget meaningfully elevates the attacker's capability by enabling request forgery or traffic interception. The fix is available and low-risk to deploy, making patching the clearly preferred path over prolonged risk acceptance.

An attacker who has already exploited a separate prototype pollution vulnerability (e.g., via a malicious JSON payload parsed by a vulnerable dependency) sets Object.prototype.data to an attacker-crafted request body. When the target application subsequently makes an axios.get() call to an internal API, axios reads the inherited data property and sends the attacker's body to the endpoint - a server-side service that naively trusts GET request bodies could be manipulated into processing attacker-controlled content. In environments using the low-level http adapter directly, setting Object.prototype.proxy can additionally route that GET request through an attacker-controlled host, enabling full traffic interception including headers and authentication tokens.