axios CVE-2026-67319

Exploitation requires two independent conditions satisfied simultaneously. First, Object.prototype must already carry attacker-influenced values from a separate prototype pollution vulnerability in the same JavaScript process - axios is a gadget consumer, not the pollution source, so the upstream vulnerability must be independently exploitable. Second, the application must pass one of the specific affected config shapes to axios: auth: {} or an auth object missing explicit own username and/or password properties, or paramsSerializer: {} or a paramsSerializer object missing own encode and/or serialize properties. Requests that omit auth and paramsSerializer entirely are not affected by this gadget. Requests that supply all relevant nested fields as explicit own properties are not affected. Full query-string serializer replacement via paramsSerializer.serialize additionally requires a function-valued pollution primitive; string-only pollution may still cause encoding changes or request failures through the encode path but cannot fully replace serialization logic. The vulnerability does not affect top-level axios config fields, which are protected by the null-prototype merge in mergeConfig.js.

The CVSS 4.0 score of 6.3 Medium with vector AV:N/AC:H/AT:P/PR:N/UI:N captures the exploitation reality well. AC:H and the explicit prerequisite flag AT:P both encode the chaining dependency: without a separate prototype pollution source in the same process, this vulnerability is entirely inert. Integrity impact is limited to VI:L and SI:L - the attacker can influence outbound request headers or query parameters on the vulnerable system and on servers receiving those requests, but cannot achieve code execution or read application data. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, which is consistent with the conditional, chained nature of exploitation. No public proof-of-concept has been identified. Real-world risk is lower than the medium score might suggest: both conditions (pre-existing prototype pollution and placeholder nested axios config objects) must be met simultaneously, narrowing the realistic attack surface compared to standalone network-exploitable flaws.

An attacker first exploits a separate prototype pollution vulnerability in the target application or one of its npm dependencies to set Object.prototype.username and Object.prototype.password to attacker-chosen credential strings. When the application subsequently makes an axios request containing auth: {} as a placeholder, axios clones the empty object into an ordinary container and reads username and password without own-property guards, causing an attacker-crafted Authorization: Basic header to be silently appended to the outbound HTTP request and transmitted to the target server. No public proof-of-concept code has been identified at time of analysis.