CVE-2026-67320

axios for Node.js hardens its merged request configuration as a null-prototype object, but request interceptors run after that merge, so a common immutable cloning pattern such as {...config} or Object.assign({}, config) converts the config back into a regular object and the Node HTTP adapter then reads config.proxy through the prototype chain. If an attacker can achieve prototype pollution of Object.prototype.proxy — typically via a separate pollution bug in the application or one of its dependencies — affected outgoing requests are routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe the Authorization header, Basic-auth credentials from config.auth, the method, absolute URL, Host header and request body, and can return its own response; HTTPS requests under normal TLS validation and browser usage are not established as impacted. Anyone running affected axios versions in a Node.js HTTP-adapter deployment is affected: versions >= 0.31.1 (fixed in 0.33.0) on the 0.x line and >= 1.15.2 (fixed in 1.18.0) on the 1.x line. No exploitation in the wild is currently known; the issue has a public advisory/PoC reference (GHSA-gcfj-64vw-6mp9), a 0.4% 30-day EPSS probability (30th percentile), and is not in CISA KEV.

What to do: Upgrade to axios 0.33.0 or later on the 0.x line, or 1.18.0 or later on the 1.x line. Until patched, audit Node.js services for request interceptors that clone configuration with {...config} or Object.assign({}, config), remediate any prototype-pollution sinks in application code or dependencies that could set Object.prototype.proxy, and prioritize patching for services that send credentials over plaintext HTTP, since HTTPS traffic under normal TLS validation is not shown to leak headers or bodies.