CVE-2026-67319 Overview
CVE-2026-67319 affects the axios HTTP client library for JavaScript. Versions prior to 0.33.0 and 1.x versions before 1.18.0 can consume inherited properties from nested request option objects when Object.prototype has already been polluted by another component in the process. Nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. The flaw is tracked under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
Critical Impact
Attackers with a pre-existing prototype pollution primitive can inject an Authorization: Basic header or alter query-string serialization on outbound HTTP requests.
Affected Products
- axios versions prior to 0.33.0
- axios1.x versions prior to 1.18.0
- Node.js and browser applications embedding vulnerable axios releases
Discovery Timeline
- 2026-08-01 - CVE-2026-67319 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67319
Vulnerability Analysis
The axios configuration merge routine constructs the top-level merged config with a null prototype, which normally blocks inherited property access. However, nested option objects, including auth and paramsSerializer, are cloned into ordinary JavaScript objects. Subsequent lookups on these nested objects use direct property reads rather than Object.prototype.hasOwnProperty.call checks.
When an application supplies placeholder nested objects such as auth: {} or paramsSerializer: {}, those empty objects inherit any values injected into Object.prototype. The library then treats the inherited values as user-provided configuration. This behavior is exploitable only when another component in the same process has already polluted Object.prototype.
Root Cause
The root cause is missing own-property validation during the merge and read of nested configuration objects. The null-prototype protection applied at the top level is not propagated to child objects created during config cloning, so inherited fields on polluted prototypes become indistinguishable from caller-supplied fields.
Attack Vector
Exploitation requires a pre-existing prototype pollution primitive in the target process. Once Object.prototype.username and Object.prototype.password are set, any axios call passing auth: {} will silently attach an Authorization: Basic header derived from the attacker-controlled values. Setting Object.prototype.encode or Object.prototype.serialize alters how query strings are built. Full serializer replacement requires the attacker to plant a function-valued pollution primitive on the prototype chain.
No verified public exploit code has been released for CVE-2026-67319. Refer to the GitHub Security Advisory GHSA-7q8q-rj6j-mhjq for technical details.
Detection Methods for CVE-2026-67319
Indicators of Compromise
- Unexpected Authorization: Basic headers on outbound HTTP requests from services that do not configure HTTP Basic authentication.
- Anomalous query-string encoding on requests generated by axios, including reordered or duplicated parameters.
- Runtime warnings or assertions triggered by prototype-pollution monitoring middleware in Node.js processes.
Detection Strategies
- Perform Software Composition Analysis (SCA) to identify installed axios versions below 0.33.0 or 1.18.0 across build and deployment pipelines.
- Instrument Node.js applications with defensive checks that log writes to Object.prototype, Function.prototype, and Array.prototype.
- Inspect outbound HTTP telemetry for the presence of Authorization: Basic headers that do not correspond to declared client credentials.
Monitoring Recommendations
- Centralize application and proxy logs and alert on unexpected authentication headers or encoding anomalies on axios-generated traffic.
- Track dependency updates in CI/CD systems and flag pull requests that pin axios to vulnerable ranges.
- Correlate prototype-pollution findings from SAST/DAST tooling with runtime request logs to prioritize remediation.
How to Mitigate CVE-2026-67319
Immediate Actions Required
- Upgrade axios to 0.33.0 or 1.18.0 (or later) across all applications and container images.
- Audit application code for upstream prototype pollution sinks that could enable this secondary attack path.
- Avoid passing empty placeholder objects such as auth: {} or paramsSerializer: {} to axios requests.
Patch Information
The maintainers addressed the issue in axios0.33.0 and 1.18.0. See the GitHub Security Advisory GHSA-7q8q-rj6j-mhjq and the VulnCheck Security Advisory for release details.
Workarounds
- Freeze Object.prototype at application startup with Object.freeze(Object.prototype) to block downstream pollution primitives.
- Replace placeholder nested option objects with Object.create(null) when calling axios, so inherited properties cannot be read.
- Validate configuration objects with own-property checks before passing them to third-party HTTP clients.
# Configuration example
npm install axios@^1.18.0
# or for the 0.x branch
npm install axios@^0.33.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
