axios CVE-2026-67320

Three conditions must simultaneously hold for exploitation. First, the attacker must be able to trigger prototype pollution on Object.prototype.proxy within the same Node.js process - this requires a separate, independently exploitable prototype pollution primitive such as an unsafe JSON.parse result merged with Object.assign or a vulnerable version of a deep-merge library. Second, the targeted axios requests must be dispatched via the Node.js HTTP adapter (default in Node.js; not the fetch adapter or any browser adapter). Third, at least one request interceptor in the axios instance must clone the config using {...config} or Object.assign({}, config) rather than returning the original null-prototype object - this is the specific pattern that strips the prototype hardening axios applies at merge time. Exploitation is limited to plaintext HTTP requests; HTTPS requests do not expose headers or body content through the proxy under normal TLS validation. An own proxy: false or any own proxy value set directly on the config also prevents exploitation regardless of prototype state.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N) scores 8.3, with AT:P (attack requirements: present) being the critical qualifier - exploitation is gated on the attacker's ability to trigger prototype pollution elsewhere in the same Node.js process. In CVSS 3.1 terms this maps more naturally to AC:H, which significantly lowers the base score and better reflects the chained nature of the attack. No CISA KEV listing exists and no public POC has been identified at time of analysis, indicating no confirmed mass exploitation. EPSS data was not provided. The real-world risk is meaningful for applications that (1) process attacker-influenced JSON or untrusted input through a prototype-pollution-vulnerable code path, (2) use axios with the Node HTTP adapter, and (3) employ common immutable interceptor patterns - all three conditions must coincide. HTTPS request bodies and headers are not exposed under normal TLS validation, limiting the highest-severity scenario to plaintext HTTP. The integrity impact (VI:L) stems from the proxy returning crafted responses, which could influence application logic. For applications that use axios exclusively for HTTPS API calls the risk is substantially lower than the base score implies.

An attacker who can submit attacker-controlled JSON to a Node.js application - for example, through an unvalidated JSON.parse call on a request body - crafts a payload that pollutes Object.prototype.proxy with their own proxy server address. On the next axios HTTP request in that process that passes through an interceptor using {...config}, axios reads the polluted prototype's proxy field and routes the request through the attacker's server, where the attacker captures the plaintext Authorization header and Basic auth credentials before forwarding the request to the legitimate endpoint. No public exploit code has been identified at time of analysis, but the technique is well-understood in the prototype-pollution literature.