{"cve":"CVE-2026-67319","nvd":{"published":"2026-08-01T13:17:02.080","modified":"2026-09-01T15:39:26.203","status":"Analyzed","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":6.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":3.7},"cwes":["CWE-1321"],"references":["https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects","https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq"],"products":["axios:axios"],"source":"nvd","synced_at":"2026-10-19T22:47:10.050265369+00:00"},"epss":{"cve":"CVE-2026-67319","score":0.00318,"percentile":0.24744,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-7q8q-rj6j-mhjq","url":"https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq","summary":"Axios: Nested axios option objects can consume polluted prototype values","modified":"2026-09-10T03:51:10.872027953Z","packages":[{"ecosystem":"npm","name":"axios","purl":"pkg:npm/axios","ranges":[">=0.8.0 <0.33.0"],"fixed":["0.33.0"]},{"ecosystem":"npm","name":"axios","purl":"pkg:npm/axios","ranges":[">=1.0.0 <1.18.0"],"fixed":["1.18.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}