Prototype Pollution Vulnerability in Axios from Axios

CVE-2026-67314

What is CVE-2026-67314?

The vulnerability in axios versions from 1.15.2 to 1.18.0 arises from handling prototype pollution through Basic authentication subfields. When applications use axios with a custom auth object lacking username and/or password properties, axios is susceptible to inheriting compromised values from the Object.prototype. This can lead to unauthorized modification of the Authorization header in outbound requests, enabling attackers to manipulate credentials. Therefore, it is crucial for developers to be vigilant and ensure that their implementations are not exposed to such risks, especially if their application environment includes already vulnerable prototypes.

References