Quick answers
- Is This vulnerability exploited in the wild?
- No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
- How severe is This vulnerability?
- Medium severity, with a CVSS score of 6.3, published 1 August 2026.
- Which products and versions are affected?
- Axios >= 1.15.2, < 1.18.0.
- Is there a fix for This vulnerability?
- A patch was published on 2026-08-07: Duplicate advisory withdrawn and fix confirmed in 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is This vulnerability attacked?
- It is attacked over the network, in a software library.
- Am I affected?
- Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Axios versions between 1.15.2 and 1.18.0 are vulnerable to a prototype pollution 'read-side gadget' in the Node.js HTTP adapter (lib/adapters/http.js) and the browser/fetch resolver (lib/helpers/resolveConfig.js). While Axios itself does not perform prototype pollution, it fails to use own-property checks when reading 'username' and 'password' from the 'auth' configuration object. If an attacker has already polluted Object.prototype via a separate vulnerability, and the application makes an Axios request with a partial or empty auth object (e.g., auth: {}), Axios will inherit and use the polluted credentials. This allows for outbound request tampering and credential injection. The issue is resolved in version 1.18.0 by implementing hasOwnProp checks.
Affected products
- axios axios >= 1.15.2, < 1.18.0
Timeline
- 2026-07-06: advisory: Original GHSA-xj6q-8x83-jv6g published
- 2026-08-01: disclosed: CVE-2026-67314 published
- 2026-08-07: patched: Duplicate advisory withdrawn and fix confirmed in 1.18.0