Prototype pollution in axios - CVE-2026-67319
Published: July 6, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote user to tamper with outbound requests and disclose sensitive information.
The vulnerability exists due to improperly controlled modification of object prototype attributes in nested axios request option objects when processing placeholder nested option objects in a JavaScript process with a polluted Object.prototype. A remote user can pollute inherited username, password, encode, or serialize properties to tamper with outbound requests and disclose sensitive information.
Exploitation requires a separate prototype-pollution primitive in the same process, and affected cases include auth or paramsSerializer objects that omit their own relevant properties.
Affected software
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
InfoSphere Optim Archive Viewer
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App
How to mitigate CVE-2026-67319
IBM Fusion HCI - update to 2.14.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2
External References
Related Security Bulletins
- Multiple vulnerabilities in axios
- Multiple vulnerabilities in IBM Watson Discovery Cartridge
- Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
- Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer
- Multiple vulnerabilities in IBM QRadar Threat Intelligence
- Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging