# CVE-2026-67319: axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process'

Source: https://junglewise.ai/threats/cve-2026-67319-axios-prototype-pollution-via-nested-option-objects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67319 · Severity: medium · CVSS 4 · Published 2026-08-01

Axios, a popular HTTP client library used in millions of Node.js and browser applications, can be exploited when the JavaScript runtime has a polluted Object.prototype. An attacker who can pollute the prototype chain can inject malicious credentials into requests (e.g., fake Authorization headers) or tamper with query parameters. This vulnerability requires a prior prototype-pollution bug elsewhere in the application stack to be exploitable.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios).

## Quick answers

**Is CVE-2026-67319 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67319 being exploited in the wild.

**How severe is CVE-2026-67319?** Medium severity, with a CVSS score of 4, published 1 August 2026.

**Which products and versions are affected?** Axios >=0.8.0 <0.33.0, >=1.0.0 <1.18.0.

**Is there a fix for CVE-2026-67319?** A patch was published on 2026-07-06: Patches released: 0.33.0, 1.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67319 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67319?** Check whether you run Axios at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a prototype-pollution gadget in Axios that affects nested request option objects (auth, paramsSerializer). While the top-level merged config is protected with Object.create(null), nested objects are cloned into ordinary objects using plain {} constructors, allowing inherited properties from a polluted Object.prototype to be read. An attacker who has already polluted Object.prototype (via a separate vulnerability elsewhere in the application) can inject or override username/password for Basic auth or inject serialize/encode functions for query-string tampering. The attack requires passing placeholder nested objects like auth: {} or paramsSerializer: {} without explicit own properties. Patched versions (0.33.0+, 1.18.0+) harden these nested objects.

## Affected products

- Axios Axios >=0.8.0 <0.33.0, >=1.0.0 <1.18.0

## Identifiers

- CVE-2026-67319
- GHSA-7q8q-rj6j-mhjq

## Timeline

- 2026-07-20: disclosed
- 2026-07-06: patched: Patches released: 0.33.0, 1.18.0

## References

- [https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq](https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)