Threats Tagged 'cve-2026-67314'

Axios versions from 1.15.2 up to but not including 1.18.0 contain prototype-pollution read-side gadgets related to Basic authentication subfield handling. This occurs when an application is already compromised by a separate prototype-pollution vulnerability and makes an axios request with an auth object missing username and/or password properties. Axios then reads inherited Object.prototype.username and Object.prototype.password values to construct the Authorization header. Axios itself does not perform prototype pollution. The vulnerability can lead to outbound request tampering by injecting attacker-controlled Basic auth credentials or replacing existing Authorization headers. Credential disclosure requires additional application-specific conditions.