CVE-2026-67314 Details

A prototype pollution vulnerability has been identified in Axios versions 1.15.2 prior to 1.18.0. This issue arises from how Axios handles Basic authentication subfields, specifically in the Node HTTP adapter and the shared resolver for browsers, web workers, and React Native. When an application affected by a separate prototype pollution vulnerability makes an Axios request with an authentication object that lacks username or password properties, Axios inadvertently reads these values from the polluted prototype. This behavior allows an attacker to manipulate the 'Authorization: Basic ...' header, potentially injecting custom credentials or replacing existing ones. While Axios does not itself pollute prototypes, the vulnerability could lead to unauthorized request tampering. Credential disclosure could occur under certain application-specific conditions.

To address this vulnerability, avoid passing empty or partial authentication objects in Axios requests. Ensure that the authentication object contains valid username and password values. Additionally, applications that merge untrusted input should filter out prototype-related properties and use own-property checks when reading optional user options.