Skip to main content

axios CVE-2026-67319

| EUVDEUVD-2026-51809 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-08-01 VulnCheck GHSA-9wx3-p993-35vp
Code Injection Prototype Pollution Axios
6.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H reflects the mandatory chaining with pre-existing prototype pollution; C:N because only outbound request integrity is affected, not confidentiality of data read.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:37 vuln.today
Analysis Generated
Aug 01, 2026 - 13:37 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 npm packages depend on axios (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.8.0.

DescriptionCVE.org

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

AnalysisAI

Prototype pollution gadget in the axios npm HTTP client silently injects Authorization headers or tampers query-string serialization when Object.prototype has already been polluted by a separate component sharing the same JavaScript process. Affected versions 0.8.0-0.32.x and 1.0.0-1.17.x fail to apply own-property guards when cloning nested config objects such as auth and paramsSerializer, allowing inherited string values from a polluted prototype to surface as request credentials or serializer overrides. No public exploit has been identified at time of analysis, and exploitation is entirely conditional on chaining with a pre-existing prototype pollution vulnerability elsewhere in the application or its dependency tree.

Technical ContextAI

axios (cpe:2.3:a:axios:axios) is a Promise-based HTTP client used across Node.js and browser environments. The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The defect is in lib/core/mergeConfig.js, which correctly protects the top-level merged config using Object.create(null) but delegates nested plain-object cloning to utils.merge({}, source), producing ordinary {} containers that inherit from Object.prototype. Downstream code in lib/adapters/http.js, lib/helpers/resolveConfig.js, and lib/helpers/buildURL.js then reads fields including auth.username, auth.password, paramsSerializer.encode, and paramsSerializer.serialize without hasOwnProperty guards. When Object.prototype carries attacker-controlled values, placeholder shapes such as auth: {} or paramsSerializer: {} silently inherit those values. String-valued pollution is sufficient to inject auth credentials; function-valued pollution primitives can additionally replace the full query-string serializer via paramsSerializer.serialize.

RemediationAI

Upgrade axios to version 0.33.0 for consumers on the 0.x branch, or to version 1.18.0 for consumers on the 1.x branch; both versions introduce own-property checks during nested config object cloning and are confirmed fixed releases per GHSA-7q8q-rj6j-mhjq and upstream pull requests https://github.com/axios/axios/pull/11000 and https://github.com/axios/axios/pull/11001. If immediate upgrade is not feasible, replace all placeholder nested config objects at every axios call site: substitute auth: {} with fully populated own-property objects such as { username: actualUser, password: actualPass }, and similarly populate paramsSerializer with explicit own encode or serialize functions, eliminating the prototype chain traversal path. Additionally, audit the application's full dependency tree for existing prototype pollution sources - this vulnerability is a secondary gadget and provides no risk if the upstream pollution is eliminated; tools such as node --inspect with Object.prototype setter traps can identify pollution sites. No axios-internal configuration flag exists to disable the affected code paths without patching.

More in Prototype Pollution

View all
CVE-2026-34621 HIGH POC
8.6 Apr 11

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
CVE-2024-56059 CRITICAL
9.8 Dec 18

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
CVE-2020-28271 CRITICAL POC
9.8 Nov 12

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
CVE-2023-38894 CRITICAL POC
9.8 Aug 16

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
CVE-2024-24292 CRITICAL POC
9.8 Mar 28

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
CVE-2023-26121 CRITICAL POC
10.0 Apr 11

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
CVE-2021-23449 CRITICAL POC
10.0 Oct 18

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
CVE-2024-39011 CRITICAL POC
9.8 Jul 30

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
CVE-2024-38988 CRITICAL POC
9.8 Mar 28

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
CVE-2025-57347 CRITICAL POC
9.8 Sep 24

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
CVE-2025-57321 CRITICAL POC
9.8 Sep 24

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
CVE-2024-45435 CRITICAL POC
9.8 Aug 29

Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2024-56059 CRITICAL
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8
CVE-2023-26121 CRITICAL POC
10.0
CVE-2021-23449 CRITICAL POC
10.0
CVE-2024-39011 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-67319 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy