{"id":"CVE-2026-67319","aliases":["CLSA-2026-1785468080","CLSA-2026-1787796805","CLSA-2026-1787828503","CLSA-2026-1787841237","CLSA-2026-1787930147","CLSA-2026-1787930357","CLSA-2026-1788195644","CLSA-2026-1790115018","CLSA-2026-1790764333","CLSA-2026-1790767846","CLSA-2026-1792139363","CLSA-2026-1792476444","CLSA-2026-1793101832","CLSA-2026-1793101849","CLSA-2026-1793110604","CLSA-2026-1793874599","DEBIAN-CVE-2026-67319","EUVD-2026-51809","GHSA-7q8q-rj6j-mhjq","GHSA-9wx3-p993-35vp","RHSA-2026:49387","RHSA-2026:49401","ROOT-APP-NPM-CVE-2026-67319","ROOT-APP-NPM-GHSA-9wx3-p993-35vp","UBUNTU-CVE-2026-67319","openSUSE-SU-2026:11680-1"],"status":"published","title":"axios before 0.33.0 Prototype Pollution via nested option objects","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00318,"percentile":0.24948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-08-01T12:22:18Z","modified":"2026-11-06T13:28:02Z","fixes":[{"ecosystem":"TuxCare:npm","package":"axios","fixed_in":["0.21.4-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-axios","fixed_in":["1.18.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"axios","fixed_in":["1.18.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/axios","fixed_in":["1.18.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.0-tuxcare.0"},{"fixed":"0.26.0-tuxcare.4"}]}],"versions":["0.26.0","0.26.0-tuxcare.1","0.26.0-tuxcare.2","0.26.0-tuxcare.3"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.1-tuxcare.0"},{"fixed":"0.18.1-tuxcare.5"}]}],"versions":["0.18.1","0.18.1-tuxcare.1","0.18.1-tuxcare.2","0.18.1-tuxcare.3","0.18.1-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.2-tuxcare.0"},{"fixed":"0.19.2-tuxcare.5"}]}],"versions":["0.19.2","0.19.2-tuxcare.1","0.19.2-tuxcare.2","0.19.2-tuxcare.3","0.19.2-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.4-tuxcare.0"},{"fixed":"0.21.4-tuxcare.4"}]}],"versions":["0.21.4","0.21.4-tuxcare.1","0.21.4-tuxcare.2","0.21.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.2-tuxcare.0"},{"fixed":"1.6.2-tuxcare.5"}]}],"versions":["1.6.2","1.6.2-tuxcare.1","1.6.2-tuxcare.2","1.6.2-tuxcare.3","1.6.2-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.2-tuxcare.0"},{"fixed":"0.27.2-tuxcare.5"}]}],"versions":["0.27.2","0.27.2-tuxcare.1","0.27.2-tuxcare.2","0.27.2-tuxcare.3","0.27.2-tuxcare.4"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.9-tuxcare.0"},{"fixed":"1.7.9-tuxcare.4"}]}],"versions":["1.7.9","1.7.9-tuxcare.1","1.7.9-tuxcare.2","1.7.9-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.5"}]}],"versions":["0.26.1","0.26.1-tuxcare.1","0.26.1-tuxcare.2","0.26.1-tuxcare.3","0.26.1-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.5-tuxcare.0"},{"fixed":"1.13.5-tuxcare.1"}]}],"versions":["1.13.5"],"bundled":28},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0-tuxcare.0"},{"fixed":"1.16.0-tuxcare.1"}]}],"versions":["1.16.0"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0-tuxcare.0"},{"fixed":"1.17.0-tuxcare.2"}]}],"versions":["1.17.0","1.17.0-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.1-tuxcare.0"},{"fixed":"1.16.1-tuxcare.2"}]}],"versions":["1.16.1","1.16.1-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.2-tuxcare.0"},{"fixed":"0.21.2-tuxcare.2"}]}],"versions":["0.21.2","0.21.2-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.2-tuxcare.0"},{"fixed":"1.13.2-tuxcare.2"}]}],"versions":["1.13.2","1.13.2-tuxcare.1"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.2-tuxcare.0"},{"fixed":"1.12.2-tuxcare.1"}]}],"versions":["1.12.2"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.6-tuxcare.0"},{"fixed":"1.13.6-tuxcare.3"}]}],"versions":["1.13.6","1.13.6-tuxcare.1","1.13.6-tuxcare.2"],"bundled":27},{"source":"osv","ecosystem":"Debian:12","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.2.1+dfsg-1","1.2.1+dfsg-1+deb12u1","1.20.0-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-1","1.6.8+dfsg-2","1.7.3+dfsg-1","1.7.4+dfsg-1","1.7.7+dfsg-1","1.7.9+dfsg-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.18.0-1","1.19.0-1","1.20.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.1+dfsg-1","1.13.2+dfsg-1","1.14.0+dfsg-1","1.15.0-1","1.15.2-1","1.16.0-1","1.8.4+dfsg-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.6-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0+dfsg-2","0.19.0+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.21.1+dfsg-1","0.23.0+dfsg-2","0.24.0+dfsg-1","0.25.0+dfsg-2","0.26.0+dfsg-1","0.26.0+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1+dfsg-1","1.5.1+dfsg-1","1.6.2+dfsg-1","1.6.8+dfsg-2","1.6.8+dfsg-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-axios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-1","1.12.1+dfsg-1","1.13.2+dfsg-1build1","1.13.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24+0.a836cced5-52.1"}]}],"bundled":19}],"products":[{"vendor":"axios","product":"axios"}],"references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","tags":["vendor-advisory","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects","tags":["third-party-advisory","Third Party Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9wx3-p993-35vp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67319.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67319","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18446","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67319","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49387.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18446","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67319","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49401.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69198","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-67319","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13149","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67319","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67321","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-67319","title":"axios before 0.33.0 Prototype Pollution via nested option objects","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T12:22:18.16Z","modified":"2026-08-03T18:26:40.355Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-51809","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T12:22:18Z","modified":"2026-08-03T18:26:40Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:24.01774Z"}],"ghsa":[{"id":"GHSA-9wx3-p993-35vp","title":"Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7q8q-rj6j-mhjq. This link is maintained to preserve external references.\n\n## Original Description\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"withdrawn","published":"2026-08-01T15:30:28Z","modified":"2026-09-01T18:41:22Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-67319","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T13:17:02.08Z","modified":"2026-09-01T15:39:26.203Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-67319","title":"axios before 0.33.0 Prototype Pollution via nested option objects","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T12:22:18.16Z","modified":"2026-10-28T02:31:01.078653645Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-67319","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T13:17:02.08Z","modified":"2026-10-01T03:03:38.858074503Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"GHSA-9wx3-p993-35vp","title":"Duplicate Advisory: Axios: Nested axios option objects can consume polluted prototype values","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7q8q-rj6j-mhjq. This link is maintained to preserve external references.\n\n## Original Description\naxios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"withdrawn","published":"2026-08-01T15:30:28Z","modified":"2026-09-10T03:51:13.769304884Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"RHSA-2026:49387","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-04T10:26:38Z","modified":"2026-10-20T10:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49401","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-04T10:26:38Z","modified":"2026-10-20T10:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-67319","description":"axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.","status":"published","published":"2026-08-01T13:17:00Z","modified":"2026-09-03T16:04:45.081225627Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1785468080","title":"TuxCare security update for axios (15 CVEs)","description":"TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-25T07:28:08.497556196Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787796805","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.18.1-tuxcare.5.","status":"published","published":"2026-08-27T02:13:25Z","modified":"2026-10-25T01:43:09.135131692Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787828503","title":"TuxCare security update for axios (3 CVEs)","description":"TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.19.2-tuxcare.5.","status":"published","published":"2026-08-27T11:01:43Z","modified":"2026-10-25T01:43:10.414931081Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787841237","title":"TuxCare security update for axios (1 CVE)","description":"TuxCare rebuilt axios to address 1 CVE. Fixed in 0.21.4-tuxcare.4.","status":"published","published":"2026-08-27T14:33:57Z","modified":"2026-10-26T13:43:05.880771568Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787930147","title":"TuxCare security update for axios (6 CVEs)","description":"TuxCare rebuilt axios to address 6 CVEs. Fixed in 1.6.2-tuxcare.5.","status":"published","published":"2026-08-28T15:15:47Z","modified":"2026-10-15T09:48:03.100688288Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787930357","title":"TuxCare security update for axios (13 CVEs)","description":"TuxCare rebuilt axios to address 13 CVEs. Fixed in 0.27.2-tuxcare.5.","status":"published","published":"2026-08-28T15:19:17Z","modified":"2026-10-15T09:47:55.213069496Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788195644","title":"TuxCare security update for axios (5 CVEs)","description":"TuxCare rebuilt axios to address 5 CVEs. Fixed in 1.7.9-tuxcare.4.","status":"published","published":"2026-08-31T17:00:44Z","modified":"2026-10-15T09:47:55.261722305Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790115018","title":"TuxCare security update for axios (4 CVEs)","description":"TuxCare rebuilt axios to address 4 CVEs. Fixed in 0.26.1-tuxcare.5.","status":"published","published":"2026-09-22T22:10:18Z","modified":"2026-10-15T09:45:34.380726026Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790764333","title":"TuxCare security update for axios (28 CVEs)","description":"TuxCare rebuilt axios to address 28 CVEs. Fixed in 1.13.5-tuxcare.1.","status":"published","published":"2026-09-30T10:32:13Z","modified":"2026-10-15T09:47:53.491657971Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790767846","title":"TuxCare security update for axios (10 CVEs)","description":"TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.0-tuxcare.1.","status":"published","published":"2026-09-30T11:30:46Z","modified":"2026-10-15T09:47:41.990250033Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792139363","title":"TuxCare security update for axios (9 CVEs)","description":"TuxCare rebuilt axios to address 9 CVEs. Fixed in 1.17.0-tuxcare.2.","status":"published","published":"2026-10-16T08:29:23Z","modified":"2026-10-16T12:15:02.196579621Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792476444","title":"TuxCare security update for axios (10 CVEs)","description":"TuxCare rebuilt axios to address 10 CVEs. Fixed in 1.16.1-tuxcare.2.","status":"published","published":"2026-10-20T06:07:24Z","modified":"2026-10-20T07:15:16.144778941Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793101832","title":"TuxCare security update for axios (11 CVEs)","description":"TuxCare rebuilt axios to address 11 CVEs. Fixed in 0.21.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:32Z","modified":"2026-11-06T13:28:02.439879551Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793101849","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.13.2-tuxcare.2.","status":"published","published":"2026-10-27T11:50:49Z","modified":"2026-10-27T13:30:17.542584318Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793110604","title":"TuxCare security update for axios (32 CVEs)","description":"TuxCare rebuilt axios to address 32 CVEs. Fixed in 1.12.2-tuxcare.1.","status":"published","published":"2026-10-27T14:16:44Z","modified":"2026-10-27T19:30:03.618389185Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793874599","title":"TuxCare security update for axios (27 CVEs)","description":"TuxCare rebuilt axios to address 27 CVEs. Fixed in 1.13.6-tuxcare.3.","status":"published","published":"2026-11-05T11:30:00Z","modified":"2026-11-05T13:15:17.383465117Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"openSUSE-SU-2026:11680-1","title":"agama-web-ui-24+0.a836cced5-52.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-24+0.a836cced5-52.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-04T00:00:00Z","modified":"2026-09-05T09:45:03.960220408Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"ROOT-APP-NPM-CVE-2026-67319","title":"CVE-2026-67319 in axios - Patched by Root","description":"Root has patched CVE-2026-67319 in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T11:11:35Z","modified":"2026-10-06T12:15:08.082190457Z","updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"ROOT-APP-NPM-GHSA-9wx3-p993-35vp","title":"GHSA-9wx3-p993-35vp in axios - Patched by Root","description":"Root has patched GHSA-9wx3-p993-35vp in the axios package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T11:11:35Z","modified":"2026-10-06T12:15:06.91461583Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}