CVE-2026-67319 Details

A prototype pollution vulnerability has been identified in Axios versions prior to 0.33.0 and in the 1.x series prior to 1.18.0. This vulnerability arises when inherited properties from nested request option objects are consumed, but only if the JavaScript process's Object.prototype has been polluted by another component. While the top-level merged configuration is safeguarded with a null prototype, nested plain objects such as 'auth' and 'paramsSerializer' are cloned into standard objects and accessed without checks for own properties. As a result, when an application sends placeholder nested objects like 'auth: {}' or 'paramsSerializer: {}', inherited values can be silently injected into outgoing requests. Specifically, inherited 'username' and 'password' values can trigger the inclusion of an 'Authorization: Basic' header, while 'paramsSerializer' fields can disrupt query-string serialization. This exploitation requires the presence of pre-existing prototype pollution.

Users can upgrade to Axios versions 0.33.0 or 1.18.0 and later. If an immediate upgrade is not possible, avoid using placeholder nested option objects. Instead, remove the 'auth' property when Basic authentication is not needed, and for 'paramsSerializer', provide specific 'encode' and 'serialize' properties or omit it if custom serialization is unnecessary.