CVE-2026-67319

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-67319) has been identified in Axios’s handling of nested request options. When another component has already polluted Object.prototype, Axios can inherit malicious values through partially configured objects such as auth: {} or paramsSerializer: {}. These inherited values can silently inject a Basic authentication header or alter query-string serialization, potentially changing outgoing requests without the application’s intent.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. In Axios, nested option objects can consume inherited properties without verifying that they belong to the objects themselves. An existing prototype pollution flaw can therefore influence authentication fields or query serialization. Exploitation requires both prior prototype pollution and an affected nested configuration object.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions:
  • >=0.8.0, <0.33.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v0.33.0
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Axios applications that supply nested request options with missing properties in an environment where Object.prototype has already been polluted. Although Axios protects its top-level merged configuration with a null prototype, nested objects can still inherit attacker-controlled values. The Axios advisory assigns a CVSS v4.0 score of 6.3.

Inherited username and password values can cause Axios to add an unintended Authorization: Basic header. Inherited encode or serialize properties can also affect query-string generation; full serializer replacement requires the attacker to inject a function-valued property. The issue affects relevant browser and Node.js request paths, but requires an affected nested option object and a separate prototype pollution vulnerability.

This behavior aligns with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Shared prototype modifications can influence downstream objects and alter application behavior. Here, the principal concern is request integrity: authentication headers or query parameters may differ from those the application intended to send.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.