Prototype pollution in axios - CVE-2026-67314

Vulnerability details

The vulnerability allows a remote user to tamper with outbound requests.

The vulnerability exists due to improper control of object prototype attributes in Basic auth handling in lib/adapters/http.js and lib/helpers/resolveConfig.js when processing requests with an own auth object that omits username or password in a host process already affected by prototype pollution. A remote user can pollute Object.prototype.username and Object.prototype.password to tamper with outbound requests.

Exploitation requires a separate prototype-pollution primitive in the host process, and affects requests where config.auth is an own object but username and/or password are absent own properties.

Affected software

How to mitigate CVE-2026-67314

External References

• https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g
• https://github.com/axios/axios/pull/10833

Related Security Bulletins

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging