CVE-2026-67316

axios, a widely used JavaScript HTTP client, contains read-side prototype-pollution gadgets that alter how requests are constructed when Object.prototype has already been polluted by a separate vulnerability or dependency. Through the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited 'data' is read via (config || {}).data before config normalization, allowing an attacker-controlled body to be attached to requests that did not set one; additionally, low-level exported adapters/helpers (lib/adapters/http.js, unsafe/helpers/resolveConfig.js) called directly with plain configs and no own proxy or paramsSerializer can inherit polluted proxy values (routing traffic through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). Successful exploitation yields low integrity impact only, per the CVSS 4.0 score of 6.3: modified request bodies, proxy routing, or URL serialization, with no confidentiality or availability impact. Applications depending on axios before 1.18.0 (or before 0.33.0 on the 0.x line) are potentially affected, though real-world exploitation requires chaining a second prototype-pollution bug, and the low-level gadgets do not reproduce through normal high-level calls on 1.15.2+. No in-the-wild exploitation is known: the issue has one public advisory/PoC (GHSA-mmx7-hfxf-jppx), a 0.4% EPSS probability, and is not in CISA KEV.

What to do: Upgrade to axios 1.18.0, or to 0.33.0 if you are pinned to the 0.x line. Because exploitation depends on Object.prototype being polluted by another component, audit your dependency tree for prototype-pollution vulnerabilities (CWE-1321) and remediate those as well, and avoid calling exported low-level adapters/helpers directly with untrusted plain configs lacking their own proxy and paramsSerializer.