This vulnerability (CVE-2026-67314) affects axios versions >=1.15.2 and <1.18.0. It involves prototype-pollution read-side gadgets in the Basic auth subfield handling within lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive, axios reads inherited prototype properties for username and password if these are omitted in the auth object, using them to build the Authorization header. Axios does not itself pollute prototypes, but this behavior allows an attacker controlling the polluted prototype to tamper with outbound requests by injecting or replacing Basic auth credentials. The impact is limited to outbound request tampering; credential disclosure is only possible under additional, application-specific conditions.

The vulnerability enables an attacker who controls polluted prototype properties to tamper with outbound HTTP requests made by axios by injecting attacker-chosen Basic authentication credentials or replacing existing Authorization headers. This can lead to unauthorized request manipulation. However, axios itself does not perform prototype pollution, and credential disclosure requires further conditions specific to the affected application. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor axios releases for a fix addressing this issue. In the meantime, avoid using vulnerable axios versions or ensure that applications are not susceptible to prototype pollution primitives that could be leveraged in conjunction with this vulnerability.