Prototype Pollution Vulnerability in Axios

CVE-2026-67316

What is CVE-2026-67316?

The Axios library contains a vulnerability allowing prototype pollution through bodyless method calls. Attackers can exploit this flaw to alter request construction if Object.prototype is already polluted by a prior vulnerability or dependency. Specifically, methods such as axios.get(), axios.delete(), axios.head(), and axios.options() can be manipulated to include attacker-controlled data when the request configuration is not properly normalized. In certain low-level paths, manipulating the configuration can lead to serious security issues, such as routing requests through an attacker-controlled proxy or improperly serializing URLs, thereby exposing applications to potential attacks. This vulnerability is mitigated in versions 1.18.0 and 0.33.0.

References