CVE-2026-67320 in axios
Summary
by MITRE • 08/01/2026
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability represents a critical security flaw in the axios HTTP client library that affects Node.js deployments using the HTTP adapter. The issue stems from improper handling of request configuration objects during the merge process, creating a pathway for attackers to manipulate proxy routing decisions through prototype pollution attacks. The vulnerability specifically targets the interaction between axios's configuration merging mechanism and its interceptor system, where the security hardening applied to prevent prototype pollution is bypassed when interceptors process the merged configuration.
The technical flaw occurs because axios implements a null-prototype object to harden merged request configurations against prototype pollution attacks, but this security measure is circumvented by the timing of interceptor execution. When interceptors run after the merge operation, common patterns like {...config} or Object.assign({}, config) convert the hardened null-prototype object back into a regular object with standard prototype inheritance. This reversion allows the Node.js HTTP adapter to traverse the prototype chain and read proxy configuration values through Object.prototype.proxy, effectively enabling attackers to redirect requests through malicious proxies they control.
The operational impact of this vulnerability is significant for applications that rely on axios for HTTP communications, particularly those handling sensitive data or authentication credentials. Attackers can exploit this flaw to intercept plaintext HTTP requests and observe potentially sensitive information including Authorization headers, Basic authentication details from config.auth, HTTP methods, absolute URLs, Host headers, and request bodies. The proxy can also return arbitrary responses to manipulate application behavior, making this a serious concern for applications processing confidential data or implementing security-sensitive operations.
This vulnerability maps directly to CWE-471, which addresses the issue of incorrect handling of prototype-based pollution attacks, and aligns with ATT&CK technique T1071.004 for application layer protocol poisoning. The attack vector specifically targets the configuration management aspect of HTTP clients, where the security controls are bypassed through improper object manipulation during interceptor processing. Organizations using affected versions of axios should immediately implement mitigations including upgrading to patched versions, implementing proper input validation for proxy configurations, and monitoring for unauthorized proxy usage patterns in their network traffic.
The vulnerability demonstrates a classic example of how security hardening can be defeated by timing issues in code execution flows, particularly when multiple layers of protection interact with different phases of object processing. The fix implemented in axios version 0.33.0 and 1.18.0 addresses this by ensuring that hardened configurations remain protected throughout the entire request lifecycle, preventing the reversion to regular objects that enables prototype chain traversal attacks. This remediation approach aligns with defensive programming principles that emphasize maintaining security controls across all execution paths and processing stages within complex software systems.