CVE-2026-67316 Details

A prototype pollution vulnerability has been identified in Axios versions 1.0.0 prior to 1.18.0 and 0.0.0 prior to 0.33.0. This vulnerability allows an attacker to manipulate request bodies in certain method aliases that do not typically include a body, such as 'axios.get()', 'axios.delete()', 'axios.head()', and 'axios.options()'. The issue arises when 'Object.prototype' has been previously polluted, enabling the injection of attacker-controlled data into requests that did not explicitly set a body. Additionally, low-level paths exist that can inherit polluted proxy or URL serialization values when specific Axios helpers or adapters are called directly with plain configuration objects. These low-level exploitation routes are not available through standard high-level Axios method calls on versions 1.15.2 and above.

Users can update to Axios versions 1.18.0 or 0.33.0 to address this vulnerability. As an interim measure, when using Axios versions prior to 1.18.0, it is recommended to explicitly set 'data: undefined' on bodyless method aliases if there is a risk of prototype pollution.