CVE-2026-67314

About vulnerability

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound ‘Authorization: Basic …’ header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

Affected product:

account-sdk , allure-codeceptjs , allure-js , appkit , axios , axios-retry , cdp-sdk , codeceptjs , configure , fcl-js , ibm-cloud-sdk-core , module-federation-typescript , onflow-fcl-rainbowkit-adapter , porto , privy-io , rainbowkit , reown-appkit , reown-appkit-adapter-bitcoin , reown-appkit-adapter-ethers , reown-appkit-adapter-ethers5 , reown-appkit-adapter-solana , reown-appkit-adapter-wagmi , reown-appkit-common , reown-appkit-controllers , reown-appkit-core , reown-appkit-experimental , reown-appkit-pay , reown-appkit-scaffold-ui , reown-appkit-siwe , reown-appkit-siwx , reown-appkit-ui , reown-appkit-universal-connector , reown-appkit-utils , reown-appkit-wallet , reown-appkit-wallet-button , retry-axios , wagmi , wagmi-connectors , walletconnect-core , walletconnect-ethereum-provider , walletconnect-monorepo , walletconnect-sign-client , walletconnect-signer-connection , walletconnect-types , walletconnect-universal-provider , x402 , x402-evm , x402-express , x402-extensions , x402-hono , x402-mcp , x402-next , x402-paywall

Affected packages:

axios @ 1.16.0 (+209 more)