Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mmx7-hfxf-jppx. This link is maintained to preserve external references. Original Description axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototyp...

GHSA-F2R5-PQH9-R8F8 Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mmx7-hfxf-jppx. This link is maintained to preserve external references. Original Description axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototyp...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67316

axios is a widely-used Node.js and browser HTTP client. CVE-2026-67316 is a read-side prototype-pollution gadget in the bodyless method aliases (get(), delete(), head(), options()): when Object.prototype has already been polluted by another dependency, inherited data is read via (config || {}).da...

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

GHSA-MMX7-HFXF-JPPX Axios: Prototype pollution gadgets can alter axios request construction

Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...

Axios: Prototype pollution gadgets can alter axios request construction

Summary axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get, axios.delete, axios.head, and axios.options read inherited da...

PT-2026-67296

Name of the Vulnerable Software and Affected Versions axios versions prior to 0.33.0 axios versions prior to 1.18.0 Description axios is susceptible to read-side prototype pollution gadgets that can alter request construction if Object.prototype has been polluted by another vulnerability or...