Prototype pollution in axios - CVE-2026-67316

Vulnerability identifier: #VU136912

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-67316

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to alter request semantics.

The vulnerability exists due to improperly controlled modification of object prototype attributes in bodyless method aliases in lib/core/Axios.js when processing requests after Object.prototype has already been polluted. A remote user can pollute Object.prototype.data to alter request semantics.

Exploitation requires chaining with a separate prototype pollution condition in the same process.

axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
Fedora
InfoSphere Optim Archive Viewer
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App
nextcloud

Install security update from vendor's website.

axios - addressed in versions 0.33.0, 1.18.0
IBM Fusion HCI - update to 2.14.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
nextcloud - addressed in versions 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2

• https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
• https://github.com/axios/axios/commit/

• Multiple vulnerabilities in axios
• Fedora EPEL 10.3 update for nextcloud
• Fedora 44 update for nextcloud
• Fedora EPEL 10.2 update for nextcloud
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging