CVE-2026-67314 in axios
Summary
by MITRE • 08/01/2026
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/02/2026
This vulnerability exists in axios versions between 1.15.2 and 1.18.0 where the library contains prototype pollution read-side gadgets in its basic authentication handling mechanism. The flaw specifically manifests in two key files: lib/adapters/http.js and lib/helpers/resolveConfig.js, which process authentication subfields when constructing outbound HTTP requests. When an application already suffers from a separate prototype pollution vulnerability and makes an axios request using an auth object that lacks username and/or password properties, the library attempts to read inherited prototype values rather than checking for explicit property existence. This occurs because axios accesses Object.prototype.username and Object.prototype.password directly without proper validation, allowing it to retrieve polluted prototype values that may have been manipulated by an attacker.
The technical implementation of this vulnerability stems from improper handling of object property access patterns in the basic authentication processing pipeline. The library does not perform explicit checks to distinguish between own properties and inherited properties when constructing authorization headers, creating a read-side gadget that can be exploited by attackers who have already achieved prototype pollution elsewhere in the application. This behavior aligns with CWE-471, which describes improper handling of object property access patterns, and represents a classic case of indirect prototype pollution exploitation through library code rather than direct pollution within the vulnerable component itself.
The operational impact of this vulnerability extends beyond simple request manipulation to potentially enable credential disclosure or authorization header replacement. An attacker who controls polluted prototype values can inject arbitrary basic authentication credentials into outbound requests, effectively allowing them to impersonate users or gain unauthorized access to protected resources. This represents a significant concern for applications that rely on axios for external communications, particularly those that process user input through the library's HTTP request mechanisms. The vulnerability creates a chain of exploitation where an initial prototype pollution primitive serves as a foothold for further attack vectors against the axios library's authentication handling.
Mitigation strategies should focus on immediate version updates to axios 1.18.0 or later, which contain fixes for this specific prototype pollution read-side gadget issue. Organizations should also implement comprehensive input validation and sanitization practices to prevent prototype pollution vulnerabilities from occurring in the first place, as these can serve as attack vectors for this particular weakness. The fix implemented by the axios team addresses the root cause by ensuring that only explicit own properties are considered when constructing authentication headers, thereby preventing read-side gadget exploitation. Additionally, security teams should conduct thorough code reviews of applications using axios to identify and remediate any existing prototype pollution vulnerabilities that could enable exploitation of this weakness through indirect means.
This vulnerability demonstrates how seemingly innocuous library functions can serve as attack vectors when they fail to properly validate object property access patterns, particularly in authentication contexts where credential manipulation can have severe security implications. The issue represents a convergence of multiple cybersecurity concepts including prototype pollution exploitation, HTTP request tampering, and supply chain security concerns where third-party libraries become potential attack surfaces for sophisticated adversaries who can leverage existing vulnerabilities in application code to achieve more serious security breaches through indirect means.