Prototype Pollution in Axios of Node.js Applications

CVE-2026-67320

What is CVE-2026-67320?

In Node.js applications utilizing the axios library, a vulnerability exists allowing an attacker to route requests through a malicious proxy due to improper handling of request configurations. When requests are merged, the hardened configuration intended to secure them may be reverted back to a standard object due to common object manipulation patterns. This allows an attacker to potentially corrupt the Object.prototype, enabling interception of sensitive data such as Authorization headers and request bodies. This vulnerability affects versions of axios prior to 0.33.0 and 1.18.0, necessitating prompt updates to safeguard against misuse.

References