Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2026-67319: axios: Insecure Nested Object Property Inheritance
CVE-2026-67319 · published 3 months ago
Summary
Old versions of axios can accidentally add sensitive information to HTTP requests if the application's code has already been compromised. This can happen when the code passes empty or placeholder objects to axios. To stay safe, update axios to the latest version.
What to do
- Update debian node-axios to version 1.18.0-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:20.04:LTS | canonical | node-axios | All versions |
| Ubuntu:22.04:LTS | canonical | node-axios | All versions |
| Ubuntu:24.04:LTS | canonical | node-axios | All versions |
| Ubuntu:26.04:LTS | canonical | node-axios | All versions |
| Debian:11 | debian | node-axios | All versions |
| Debian:12 | debian | node-axios | All versions |
| Debian:13 | debian | node-axios | All versions |
| Debian:14 | debian | node-axios |
< 1.18.0-1 Fix: upgrade to 1.18.0-1
|
| – | axios | axios |
< 0.33.0 < 1.18.0 >= 1.0.0, < 1.18.0 |
Original advisory text
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another c...
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.
References
- https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq vendor-advisory
- https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested... third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2026-67319 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-67319 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-67319 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Type
CWE-1321Prototype Pollution
Timeline
Published1 Aug 2026
Updated4 Nov 2026
First seen1 Aug 2026
Sources
UBUNTU-CVE-2026-67319 · OSV
DEBIAN-CVE-2026-67319 · OSV
CVE-2026-67319 · NVD
CVE-2026-67319 · MITRE
Track software like this
Free during beta