CVE-2026-67314 Overview
CVE-2026-67314 affects the axios HTTP client library in versions >=1.15.2 and <1.18.0. The library contains prototype-pollution read-side gadgets in Basic authentication subfield handling within lib/adapters/http.js and lib/helpers/resolveConfig.js. When an axios request supplies an auth object that omits the username or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values. The library then uses those values to build the outbound Authorization: Basic ... header. The weakness is categorized under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).
Critical Impact
An attacker who controls polluted prototype values can inject or replace Basic auth credentials on outbound HTTP requests, enabling request tampering and, under specific application conditions, credential disclosure.
Affected Products
- axios versions >=1.15.2 and <1.18.0
- Node.js applications using axios http adapter with dynamic auth configuration
- Applications composing axios requests from user-influenced data when a separate prototype-pollution primitive exists
Discovery Timeline
- 2026-08-01 - CVE-2026-67314 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67314
Vulnerability Analysis
The vulnerability is a read-side prototype-pollution gadget rather than a pollution primitive. Axios itself does not modify Object.prototype. The library trusts inherited properties on the auth configuration object when constructing outbound HTTP requests. This behavior turns axios into an amplifier for prototype pollution that exists elsewhere in the application. The practical outcome is outbound request tampering, where an attacker who taints the prototype can control which credentials axios attaches to a request.
Root Cause
The root cause lies in lib/adapters/http.js and lib/helpers/resolveConfig.js. When resolving the auth object, axios accesses the username and password properties without checking whether they are own-properties of the passed object. If the caller passes an auth object that lacks these keys, JavaScript's prototype chain lookup returns values from Object.prototype.username and Object.prototype.password when those have been polluted. Axios then base64-encodes and inserts the result into the Authorization header.
Attack Vector
Exploitation requires a pre-existing prototype-pollution primitive in the target application. The attacker uses that primitive to set Object.prototype.username and Object.prototype.password to attacker-chosen values. When the application later invokes axios with an auth object missing those fields, the outbound request carries the attacker-controlled Basic auth header. This can replace an existing Authorization header, cause the application to authenticate to an upstream service under attacker-controlled credentials, or, in specific application patterns where responses reflect request headers, expose credentials. Refer to the GitHub Security Advisory GHSA-xj6q-8x83-jv6g and the VulnCheck Advisory on Axios for further technical context.
Detection Methods for CVE-2026-67314
Indicators of Compromise
- Outbound HTTP requests containing unexpected Authorization: Basic headers to internal or third-party endpoints
- Base64-decoded credentials in outbound headers that do not correspond to any known application account
- Node.js processes with runtime modifications to Object.prototype observed in heap snapshots or diagnostic reports
Detection Strategies
- Perform software composition analysis to identify axios versions between 1.15.2 and 1.18.0 in package.json and package-lock.json files.
- Audit application code for axios calls where auth objects are built from user-influenced input or spread from external sources.
- Search runtime logs and proxy logs for anomalous Authorization headers on requests originating from Node.js services.
Monitoring Recommendations
- Log and inspect outbound HTTP traffic from Node.js workloads at an egress proxy to identify unexpected Basic auth headers.
- Instrument applications to detect writes to Object.prototype using runtime hooks or defensive Object.freeze(Object.prototype) in bootstrap code.
- Alert on axios request telemetry when the resolved auth.username differs from configured service accounts.
How to Mitigate CVE-2026-67314
Immediate Actions Required
- Upgrade axios to version 1.18.0 or later across all Node.js services and rebuild dependent container images.
- Inventory transitive dependencies pulling in vulnerable axios ranges using npm ls axios or equivalent tooling.
- Audit application code paths that construct axios auth objects from dynamic sources and confirm they contain explicit username and password keys.
Patch Information
Upgrade to axios1.18.0 or newer. The fix ensures the library only consults own-properties of the auth object when constructing the Basic authentication header. Details are published in the GitHub Security Advisory GHSA-xj6q-8x83-jv6g.
Workarounds
- Freeze the prototype at process startup with Object.freeze(Object.prototype) to block pollution primitives from taking effect.
- Construct auth objects with Object.create(null) so the object has no prototype chain to inherit from.
- Explicitly assign username and password values on every axios request that uses Basic authentication, even if the values are empty strings.
# Upgrade axios to the fixed release
npm install axios@^1.18.0
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
