CVE-2026-67316 is a high severity prototype pollution gadget issue in axios. When Object.prototype has already been polluted by another flaw, axios bodyless method aliases can send an attacker controlled body. The record scores it 7.4 and the advisory 6.3. Axios 1.18.0 and 0.33.0 fix it.
What's affected
The advisory lists the patched versions as 1.18.0 and 0.33.0. It states the affected range as "1.0.0 to 0.32.0" which reads as a garbled range, so treat anything before the patched versions on either line as affected.
Severity differs. The record gives CVSS 7.4 (High). The axios advisory rates it Moderate, 6.3. The weakness is CWE-1321, improperly controlled modification of object prototype attributes.
This issue is a gadget, which means it needs a second bug to be exploitable. The advisory says axios reads inherited data in the bodyless aliases, axios.get, axios.delete, axios.head and axios.options, before it normalizes the config. If Object.prototype already carries a data property, axios sends it as a body on requests that set none.
Two more paths exist for code that calls low level adapters or helpers directly with plain config objects. Inherited proxy or paramsSerializer values could route a request through a proxy or change URL serialization. The advisory says these do not reproduce through normal axios calls on 1.15.2 and later.
How to check if you're exposed
Find every copy of axios, direct and transitive:
npm ls axios
npm why axios
Yarn and pnpm users can run yarn why axios or pnpm why axios. Look at the lockfile too, since a transitive dependency can pin an older copy than your top level package.json suggests.
The real question is whether something in your stack can pollute Object.prototype. Check your dependencies for known prototype pollution issues, since this bug only matters when another one exists. Also check whether your code imports axios internals such as the unsafe adapter or helper paths.
What to do now
- Upgrade axios to 1.18.0, or 0.33.0 on the 0.x line.
- Update any dependency with a known prototype pollution flaw.
- Avoid calling axios low level adapters or helpers with plain config objects.
- Check services that receive GET, DELETE, HEAD or OPTIONS requests with bodies and decide whether they should accept them.
- Paste your dependency file into the free in-browser scan at gold.safeguard.sh/scan to see which of your projects pull in an affected version.
Why it matters
Prototype pollution changes the shared template that all JavaScript objects inherit from. A library that reads a property without checking whether it belongs to the object itself can pick up a value the attacker planted. The planted value then shows up in places the developers never expected.
The advisory describes the main effect, a request body on a method that normally has none, which can corrupt the meaning of a request. The rating is moderate because of the second bug requirement. Layered flaws like this are where an inventory of dependencies helps: it shows which projects carry both halves.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Can this be exploited on its own?
No. The advisory says Object.prototype must already be polluted by a separate vulnerability or dependency.
Which methods are affected?
The bodyless aliases get, delete, head and options in the main path, per the advisory.
Sources
Last reviewed: 18 October 2026.
