Npm · Axios · CVE-2026-67320
**Name of the Vulnerable Software and Affected Versions**
axios versions 0.31.1 through 0.32.x
axios versions 1.15.2 through 1.17.x
**Description**
In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy. While the software initially creates a null-prototype object for request configuration to prevent prototype pollution, request interceptors that use immutable patterns—such as `{...config}` or `Object.assign({}, config)`—convert this back into a regular object. Because the software does not re-harden the configuration before dispatch, the Node HTTP adapter reads the `config.proxy` variable through the prototype chain. If an attacker pollutes `Object.prototype.proxy`, they can intercept plaintext HTTP requests to observe `Authorization` headers, Basic auth from `config.auth`, the request method, absolute URL, `Host` header, and the request body, and can also return custom responses. This issue does not affect browser adapters or HTTPS requests under normal TLS validation.
**Recommendations**
Update axios to version 0.33.0 or later for the 0.x branch.
Update axios to version 1.18.0 or later for the 1.x branch.
As a temporary workaround, set `proxy: false` on affected requests or axios instances when proxy support is not required.
Avoid using request interceptors that return regular object clones of the configuration.
Use the Node fetch adapter for affected requests where compatible with the application.