CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If successfully exploited, an attacker can route affected plaintext HTTP requests through a malicious proxy, potentially observing sensitive data such as authentication headers and request bodies, and even returning their own responses.

This vulnerability is rated as Important because an attacker capable of polluting prototype properties can hijack outbound network requests, leading to the interception of sensitive bearer tokens, authentication credentials, and request payloads. In Red Hat product deployments utilizing Node.js services, exploitation depends on an existing, separate prototype pollution vector and the use of custom request interceptors that re-instantiate request options as standard objects. Requests dispatched over TLS-encrypted connections under standard certificate verification substantially restrict data exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.