Prototype Pollution in Axios
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-poll…
Vulnerability class: Prototype Pollution
Affected products
- Axios — versions 1.15.2, 1.18.0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)