Executive brief
Axios, a widely used library for making web requests, contains a vulnerability that can be exploited if the host application is already compromised by a separate security flaw. An attacker can manipulate the authentication credentials sent by the application to external services. This could allow an attacker to hijack outbound requests or cause authentication failures, potentially disrupting operations or tampering with data sent to third-party APIs.
Technical details
Axios versions between 1.15.2 and 1.18.0 are vulnerable to a prototype pollution 'read-side gadget' in the Node.js HTTP adapter (lib/adapters/http.js) and the browser/fetch resolver (lib/helpers/resolveConfig.js). While Axios itself does not perform prototype pollution, it fails to use own-property checks when reading 'username' and 'password' from the 'auth' configuration object. If an attacker has already polluted Object.prototype via a separate vulnerability, and the application makes an Axios request with a partial or empty auth object (e.g., auth: {}), Axios will inherit and use the polluted credentials. This allows for outbound request tampering and credential injection. The issue is resolved in version 1.18.0 by implementing hasOwnProp checks.
Affected products
- axios axios >= 1.15.2, < 1.18.0
Timeline
- 2026-07-06: advisory: Original GHSA-xj6q-8x83-jv6g published
- 2026-08-01: disclosed: CVE-2026-67314 published
- 2026-08-07: patched: Duplicate advisory withdrawn and fix confirmed in 1.18.0