CVE-2026-67320 is a high severity (CVSS 7.5) information disclosure issue in axios on Node.js. A common interceptor pattern can undo axios hardening, so an inherited proxy setting may send plaintext HTTP requests through an attacker's proxy. Upgrade to axios 0.33.0 or 1.18.0.
What's affected
The record and the GitHub advisory (GHSA-gcfj-64vw-6mp9) agree on the ranges. Affected: axios from 0.31.1 (fixed in 0.33.0) and from 1.15.2 (fixed in 1.18.0).
Three conditions have to line up, per the advisory:
- You use the Node.js HTTP adapter.
- A request interceptor returns a regular object copy of the config, for example by spreading it or using Object.assign into an empty object.
- An attacker has already managed to pollute Object.prototype with a proxy property.
The record is explicit about limits. It says this does not establish browser impact, and it does not establish disclosure of HTTPS headers or bodies under normal TLS validation. The exposure it describes is for plaintext HTTP requests. Both the NVD record and the advisory rate it High.
How to check if you're exposed
npm ls axios
npm why axios
npm ls prints every copy of the package in the tree with its version. npm why shows which dependency pulled each copy in, which matters because a transitive copy is not fixed by bumping your own direct dependency.
Next, look for interceptors that clone the config:
grep -rn "interceptors.request" src
For each hit, read what the function returns. If it returns the original config object, or a copy made as a null-prototype object, it is not the pattern the advisory describes. If it returns a plain spread or Object.assign copy, treat the service as in scope until you upgrade.
Also ask whether you send credentials over plain HTTP anywhere. Those calls are where the record says the proxy can see Authorization headers and Basic auth.
A quicker route for a whole project is the free in-browser dependency scan at Gold. Paste a manifest or lockfile and it matches each dependency against known CVEs, including ones pulled in indirectly.
What to do now
- Upgrade to axios 0.33.0 (0.x line) or 1.18.0 (1.x line) or later.
- Where a proxy is not needed, set proxy to false on the affected requests or on the axios instance, as the advisory suggests.
- Review request interceptors that return a copy of config. The advisory notes that returning the original config or a null-prototype copy avoids this specific bypass, but calls that approach fragile and not a replacement for the fix.
- Move any plaintext HTTP calls that carry credentials to HTTPS.
- Treat prototype pollution findings elsewhere in your stack as relevant here, since this issue needs one to be present.
Reachability analysis helps with ordering the work. Knowing whether your code actually calls the affected path tells you which services to patch first.
Why it matters
The class is CWE-200, exposure of sensitive information. The interesting part is the mechanism. axios builds its merged request config as an object with no prototype, which stops inherited properties from leaking in. Interceptors run after that step and may return a replacement config. A normal copy of the object gets a prototype again, and axios then sends it on without hardening it a second time.
That is why the issue is a chain, not a single bug. It needs prototype pollution somewhere else first. Chains like this are where reachability analysis earns its keep: a service with no interceptors and no pollution path is far lower risk than one with both. The record does not list this CVE as known exploited.
Try it yourself
This demo shows how checking whether the vulnerable path is reachable changes which findings you fix first.
Click through it at your own pace, or open it full screen.
Quick check
Does this put HTTPS traffic at risk?
The record says it does not establish HTTPS header or body disclosure under normal TLS validation. The described exposure is for plaintext HTTP requests.
Is a direct axios upgrade enough?
Only if no other copy remains in the tree. Run npm ls axios and check each copy.
Sources
- https://github.com/axios/axios/security/advisories/GHSA-gcfj-64vw-6mp9
- Record: NVD entry for CVE-2026-67320 (score 7.5, HIGH)
Last reviewed: 18 October 2026.
