CVE-2026-67314

CVE-2026-67314 is a prototype-pollution 'read-side' gadget in the axios HTTP library (versions >= 1.15.2 and < 1.18.0), where Basic authentication subfield handling in lib/adapters/http.js and lib/helpers/resolveConfig.js falls back to inherited Object.prototype.username and Object.prototype.password values when an application-supplied auth object omits those properties. It is triggered only when the host application is already affected by a separate prototype-pollution primitive (axios itself never pollutes prototypes) and then makes an axios request with an own auth object missing username and/or password. An attacker who controls the polluted prototype values can inject attacker-chosen Basic credentials or replace an existing Authorization header on outbound requests, tampering with the application's outbound authentication; credential disclosure is possible only under additional application-specific conditions. Any application running an affected axios version that also contains a prototype-pollution weakness elsewhere is affected. No in-the-wild exploitation is known; a public vendor advisory with a PoC reference (GHSA-xj6q-8x83-jv6g) exists and EPSS is low at 0.4% (28th percentile), with no CISA KEV listing.

What to do: Upgrade axios to 1.18.0 or later, which resolves the read-side gadgets in the Basic auth handling. Because the flaw only manifests when Object.prototype is polluted by another component, audit your dependency tree for separate prototype-pollution sinks (CWE-1321, e.g. unsafe deep-merge utilities) and check whether outbound axios requests can run with auth objects that omit username/password. As an interim mitigation, always set both username and password explicitly on axios auth objects and fix any code paths that let attacker-controlled input pollute Object.prototype.