Prototype Pollution in Axios Library Affecting Multiple Versions

CVE-2026-67319

What is CVE-2026-67319?

The Axios library, prior to version 0.33.0 and version 1.18.0 in the 1.x stream, is vulnerable to a prototype pollution flaw. This vulnerability arises when applications pass nested request option objects that can inherit properties from maliciously manipulated prototypes in JavaScript. Specifically, the affected configuration handles top-level options with a null prototype but fails to safely manage nested objects, leading to potential silent injection of critical authorization headers (e.g., Authorization: Basic) and altering of serialization processes. Such exploitation is contingent on the existence of prior prototype pollution, allowing attackers to inject unexpected behavior into applications relying on this widely-used HTTP client.

References