CVE-2026-67316

Name of the Vulnerable Software and Affected Versions axios versions prior to 0.33.0 axios versions prior to 1.18.0

Description axios is susceptible to read-side prototype pollution gadgets that can alter request construction if Object.prototype has been polluted by another vulnerability or dependency. In bodyless method aliases such as axios.get(), axios.delete(), axios.head(), and axios.options(), the software reads inherited data via (config || {}).data before config normalization. This allows an attacker to inject a controlled request body into requests that were not intended to have one, potentially corrupting request semantics on the receiving service.

Additionally, low-level paths are affected when exported adapters or helpers (such as lib/adapters/http.js and unsafe/helpers/resolveConfig.js) are called directly with plain configurations. In these instances, the software may inherit polluted proxy values, routing requests through an attacker-controlled proxy, or polluted paramsSerializer values, allowing attacker-controlled URL serialization. These low-level issues do not occur during normal high-level axios calls in versions 1.15.2 and later.

Recommendations Update axios to version 0.33.0 or later. Update axios to version 1.18.0 or later. As a temporary mitigation, explicitly pass data: undefined when using bodyless method aliases in environments where prototype pollution is a concern. Avoid processing untrusted input with libraries or code paths capable of polluting Object.prototype.