CVE-2026-67319

A flaw was found in axios. When the JavaScript environment's Object.prototype has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized authentication headers, potentially exposing sensitive credentials. Additionally, it could allow an attacker to alter how data is formatted for requests, leading to data manipulation. This vulnerability is only exploitable if another component has already introduced prototype pollution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.