CVE-2026-67316

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-67316) has been identified in Axios’s request construction logic. When another component has already polluted Object.prototype, method aliases such as axios.get() and axios.delete() can inherit a malicious data property before configuration normalization. This can cause Axios to send an attacker-controlled request body even when the application did not specify one, potentially altering how the receiving service processes the request.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. Modified prototype properties can influence objects that inherit them, changing application behavior. In Axios, previously polluted properties can affect request bodies and certain low-level configuration reads. Exploitation requires a separate vulnerability or dependency to pollute the shared prototype first.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions:
  • >=1.0.0, <1.18.0
  • <0.33.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.18.0
  • OSS Axios v0.33.0
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Axios applications running with an already polluted Object.prototype. The get, delete, head, and options aliases can read inherited data before normalizing configuration, introducing an unintended request body. The Axios advisory assigns a CVSS v4.0 score of 6.3.

Additional paths can inherit malicious proxy or paramsSerializer values when applications call exported adapters or helpers directly with plain configuration objects. These paths can alter routing or URL serialization, but were not reproduced through normal high-level Axios calls on versions 1.15.2 and later.

This behavior aligns with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The impact depends on which inherited properties are consumed and how receiving services interpret the resulting requests. Prior prototype pollution is a required condition; this issue supplies downstream behavior that makes that pollution exploitable.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.