Axios Prototype Pollution; fixed in 1.18.0 & 0.33.0
CVE-2026-67316 Published on August 1, 2026
axios before 1.18.0 Prototype Pollution via bodyless methods
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.
Weakness Type
What is a Prototype Pollution Vulnerability?
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVE-2026-67316 has been classified to as a Prototype Pollution vulnerability or weakness.
Products Associated with CVE-2026-67316
Want to know whenever a new CVE is published for Axios? stack.watch will email you.
Affected Versions
axios:- Version 1.0.0 and below 1.18.0 is affected.
- Version 1.18.0 is unaffected.
- Before 0.33.0 is affected.
- Version 0.33.0 is unaffected.