CVE-2026-67316
Received Received - Intake

Prototype Pollution in Axios Leading to Request Manipulation

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67316
EUVD
EUVD-2026-51827

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
axios axios to 1.18.0 (exc)
axios axios to 0.33.0 (inc)
axios axios 1.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

axios is vulnerable to prototype-pollution gadgets that can alter request construction if Object.prototype is already polluted. This affects bodyless methods like axios.get() or axios.delete() where attacker-controlled data can be sent even if no body was set. Low-level paths may also inherit polluted proxy or paramsSerializer values.

Detection Guidance

Check axios version with npm list axios or grep -r "axios" package.json. If version is below 1.18.0 or 0.33.0, the system is vulnerable. Inspect network requests for unexpected body data in GET, DELETE, HEAD, or OPTIONS calls.

Impact Analysis

An attacker could manipulate requests to send unintended data or route traffic through malicious proxies. This could lead to unauthorized actions, data leaks, or service disruptions if Object.prototype is already polluted by another vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, violating GDPR's data protection principles or HIPAA's integrity and confidentiality requirements. Compliance may be compromised if attacker-controlled requests alter or exfiltrate sensitive data.

Mitigation Strategies

Upgrade axios to version 1.18.0 or 0.33.0 immediately. Review dependencies for prototype pollution risks. Monitor network traffic for unusual requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart