axios before 0.33.0 Prototype Pollution via nested option objects

Description

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

Scores

EPSS (exploitation in 30 days)

0.32% · top 75% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (opens in a new tab)All about CWE-1321 and its CVEs

Affected products

• axios · axios

  • affected 0.8.0 – < 0.33.0
  • unaffected 0.33.0

• axios · axios

  • affected 1.0.0 – < 1.18.0
  • unaffected 1.18.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmaxiosGHSA-7q8q-rj6j-mhjq (opens in a new tab)

References (2)

• GitHub Security Advisory (GHSA-7q8q-rj6j-mhjq) (opens in a new tab)vendor-advisoryexploit
• VulnCheck Advisory: axios before 0.33.0 Prototype Pollution via nested option objects (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-7q8q-rj6j-mhjq (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-67319](https://trackcve.app/badge/CVE-2026-67319.svg)](https://trackcve.app/cve/CVE-2026-67319)

Record last updated 3 Aug 2026, 18:26 UTC.