Prototype Pollution in Axios

CVE-2026-67319

axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged confi…

Vulnerability class: Prototype Pollution

Affected products

  • Axios — versions 0.8.0, 0.33.0, 1.0.0

Weakness classification (CWE)

References