CVE-2026-67316

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.

Low impact. This prototype pollution vulnerability in axios requires a pre-existing Object.prototype pollution from another flaw. Exploitation is further limited as the more severe aspects, such as proxy or paramsSerializer pollution, do not affect normal high-level axios API calls in versions 1.15.2 and later, which are common in Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.