Skip to content
Fencer Vulns
high 7.5

CVE-2026-67320 json

axios before 0.33.0 Prototype Pollution via Node HTTP adapter

published 2026-07-20 3 mo ago modified 2026-09-10 1 mo ago also GHSA-gcfj-64vw-6mp9 , EUVD-2026-51847

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the hardened config back into a regular object. axios then dispatches that object without re-hardening it, and the Node HTTP adapter reads config.proxy through the prototype chain. If an attacker can pollute Object.prototype.proxy, affected requests can be routed through an attacker-controlled proxy. For plaintext HTTP requests, the proxy can observe Authorization headers, Basic auth from config.auth, method, absolute URL, Host, and request body, and can return its own response. This does not establish browser impact or HTTPS header/body disclosure under normal TLS validation. Affected versions are >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0).

Patch / fix

  • npm axios 0.33.0, 1.18.0
  • axios axios 0.33.0, 1.18.0
  • node-axios Debian 14 1.18.0-1

debian advisories DEBIAN-CVE-2026-67320

  • grafana13.1 hummingbird 1 13.1.1-0.3.hum1
  • jaeger hummingbird 1 2.20.0-0.8.hum1
  • grafana12.4 hummingbird 1 12.4.6-0.2.hum1

red hat advisories RHSA-2026:48241RHSA-2026:48758RHSA-2026:47619

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1

opensuse advisories openSUSE-SU-2026:12070-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-67320 updated cvss 7.4

axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9
    affected: no fix available
  • Red Hat Ansible Automation Platform 2 python-galaxy-ng, automation-gateway
    affected: no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9
    affected: no fix available
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-rhel10, rhtpa/rhtpa-trustification-service-rhel9
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/console-rhel9 1787687062
    fixed: vendor fix RHSA-2026:60387
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/console-rhel9 1787339249
    fixed: vendor fix RHSA-2026:60390
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1787339248
    fixed: vendor fix RHSA-2026:60388
show 27 more
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1789411320
    fixed: vendor fix RHSA-2026:67714
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1789411269
    fixed: vendor fix RHSA-2026:67711
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1788775748
    fixed: vendor fix RHSA-2026:65118
  • Red Hat Container Native Virtualization 4.12 container-native-virtualization/kubevirt-console-plugin 1787651005
    fixed: vendor fix RHSA-2026:61691
  • Red Hat Hardened Images jaeger 2.20.0-0.8.hum1, grafana12.4 12.4.6-0.2.hum1, grafana13.1 13.1.1-0.3.hum1
    fixed: vendor fix RHSA-2026:47619
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1788312226, rhoai/odh-mod-arch-model-registry-rhel9 1788312157
    fixed: vendor fix RHSA-2026:65126
  • Red Hat OpenShift AI 3.4 rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1793001859, rhoai/odh-mod-arch-automl-rhel9 1791861032, rhoai/odh-mod-arch-gen-ai-rhel9 1791861479, rhoai/odh-mod-arch-mlflow-rhel9 1793001851, +3 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/dashboard-rhel9 1789162884
    fixed: vendor fix RHSA-2026:68754
  • Red Hat OpenShift Dev Spaces 3.31 devspaces/code-rhel9 1792599388
    fixed: vendor fix RHSA-2026:90321
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Quay 3.9 quay/quay-rhel8 1788595574
    fixed: vendor fix RHSA-2026:65514
  • Red Hat Quay 3.10 quay/quay-rhel8 1788561841
    fixed: vendor fix RHSA-2026:66084
  • Red Hat Quay 3.12 quay/quay-rhel8 1788594376
    fixed: vendor fix RHSA-2026:66523
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Quay 3.15 quay/quay-rhel8 1788191755
    fixed: vendor fix RHSA-2026:63307
  • Red Hat Quay 3.16 quay/quay-rhel9 1789563753
    fixed: vendor fix RHSA-2026:69255
  • Red Hat Quay 3.17 quay/quay-rhel9 1790690298
    fixed: vendor fix RHSA-2026:74511
  • Red Hat Quay 3.18 quay/quay-rhel9 1791265590
    fixed: vendor fix RHSA-2026:81110
  • Red Hat Satellite 6.18 satellite/iop-vulnerability-frontend-rhel9 1789660969, satellite/iop-host-inventory-frontend-rhel9 1788322243
    fixed: vendor fix RHSA-2026:63373
  • Red Hat Satellite 6.19 satellite/iop-advisor-frontend-rhel9 1789659565, satellite/iop-vulnerability-frontend-rhel9 1789660983, satellite/iop-host-inventory-frontend-rhel9 1788260941
    fixed: vendor fix RHSA-2026:68748
  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-pf4-rhel9, network-observability/network-observability-console-plugin-pf5-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2.11 rhacm2/thanos-rhel9 1787685239, rhacm2/prometheus-rhel9 1787261499, rhacm2/acm-grafana-rhel9 1787682482, rhacm2/acm-search-v2-rhel9 1787688827, rhacm2/node-exporter-rhel9 1787263326, rhacm2/observatorium-rhel9 1787263596, +34 more Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1787263906, rhacm2/acm-cli-rhel9 1787259085, rhacm2/prometheus-rhel9 1787263757, rhacm2/acm-grafana-rhel9 1787644958, rhacm2/acm-search-v2-rhel9 1787682112, rhacm2/node-exporter-rhel9 1787263178, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1787614805, rhacm2/acm-cli-rhel9 1786923505, rhacm2/prometheus-rhel9 1786976997, rhacm2/acm-grafana-rhel9 1787645355, rhacm2/acm-search-v2-rhel9 1787682033, rhacm2/node-exporter-rhel9 1787233241, +37 more
    not affected: vulnerable code not present

22 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm axios
>=0.31.1, <0.33.0
>=1.15.2, <1.18.0
0.33.0
1.18.0

Affected products

  • axios axios

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.