CVE-2026-67320 Details

A vulnerability exists in Axios versions 0.31.1 prior to 0.33.0 and 1.15.2 prior to 1.18.0, when used in a Node.js environment with the HTTP adapter. This vulnerability allows for prototype pollution that can be exploited to route HTTP requests through an attacker-controlled proxy. Although Axios attempts to secure merged request configurations by creating a null-prototype object, this hardening is undone by request interceptors that run afterward. Interceptors that use common patterns to clone objects can revert the configuration back to a standard object, which then inherits from the prototype chain. If an attacker has previously polluted the prototype, they can manipulate the proxy configuration, leading to the interception of sensitive request data such as Authorization headers, Basic authentication details, request methods, absolute URLs, Host headers, and request bodies. The proxy can also send its own responses back through Axios, effectively allowing for man-in-the-middle style attacks on the HTTP requests.

Users can upgrade to Axios versions 0.33.0 or 1.18.0, where this vulnerability has been patched. Alternatively, for versions that are not yet upgraded, an own 'proxy: false' can be set on the request or Axios instance. If the Node fetch adapter is an option, it can be used as a replacement for affected requests.