CVE-2026-67314: axios before 1.18.0 Prototype Pollution via auth subfields

Vulnerability summary

CVE-2026-67314 is a medium (CVSS 6.5) vulnerability in axios. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-08-2026
   PublishedVulnerability first disclosed.
2. 03-08-2026
   Last modifiedVulnerability information updated.

Description

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

• CWE-1321Improperly Controlled Modification of Object Prototype AttributesThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.