# Axios prototype pollution in Basic auth subfield handling

Source: https://junglewise.ai/threats/axios-prototype-pollution-in-basic-auth-subfield-handling-84a58e9b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-08-07  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.3 · Published 2026-08-01

Axios, a widely used library for making web requests, contains a vulnerability that can be exploited if the host application is already compromised by a separate security flaw. An attacker can manipulate the authentication credentials sent by the application to external services. This could allow an attacker to hijack outbound requests or cause authentication failures, potentially disrupting operations or tampering with data sent to third-party APIs.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.3, published 1 August 2026.

**Which products and versions are affected?** Axios >= 1.15.2, < 1.18.0.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-07: Duplicate advisory withdrawn and fix confirmed in 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Axios versions between 1.15.2 and 1.18.0 are vulnerable to a prototype pollution 'read-side gadget' in the Node.js HTTP adapter (lib/adapters/http.js) and the browser/fetch resolver (lib/helpers/resolveConfig.js). While Axios itself does not perform prototype pollution, it fails to use own-property checks when reading 'username' and 'password' from the 'auth' configuration object. If an attacker has already polluted Object.prototype via a separate vulnerability, and the application makes an Axios request with a partial or empty auth object (e.g., auth: {}), Axios will inherit and use the polluted credentials. This allows for outbound request tampering and credential injection. The issue is resolved in version 1.18.0 by implementing hasOwnProp checks.

## Affected products

- axios axios >= 1.15.2, < 1.18.0

## Timeline

- 2026-07-06: advisory: Original GHSA-xj6q-8x83-jv6g published
- 2026-08-01: disclosed: CVE-2026-67314 published
- 2026-08-07: patched: Duplicate advisory withdrawn and fix confirmed in 1.18.0

## References

- [https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g](https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g)
- [https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields](https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)