{"items":[{"id":"NVI-00014145","kind":"vulnerability","title":"Axios: Nested axios option objects can consume polluted prototype values","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7q8q-rj6j-mhjq","CVE-2026-67319"],"plain_summary":"GitHub lists this reviewed advisory for axios, axios. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4fe2b61f76e6db5befbe85cf2afe4ffa"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4fe2b61f76e6db5befbe85cf2afe4ffa","url":"https://github.com/advisories/GHSA-7q8q-rj6j-mhjq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7q8q-rj6j-mhjq","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:21:50.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4fe2b61f76e6db5befbe85cf2afe4ffa"],"technology":"axios","known_exclusions":[],"conditions_summary":"## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.\n\n## Impact\n\nThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.\n\nConfirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.\n\nThe `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.\n\nThis does not mean every axios request i","public_affected_ranges":[">= 0.8.0, < 0.33.0"]},{"certainty":"source_listed","source_ids":["sr-4fe2b61f76e6db5befbe85cf2afe4ffa"],"technology":"axios","known_exclusions":[],"conditions_summary":"## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound requests.\n\n## Impact\n\nThis is reachable only when another component has already polluted `Object.prototype` and the application passes an affected nested axios option object.\n\nConfirmed impacts include silent injection of an `Authorization: Basic ...` header from inherited `username` and `password` values, and query-string tampering when inherited `paramsSerializer` fields are function-valued.\n\nThe `auth` case requires only string-valued pollution. Full query-string replacement through `paramsSerializer.serialize` requires a function-valued pollution primitive; string-only pollution may still cause request failures or encoding changes through `encode`.\n\nThis does not mean every axios request i","public_affected_ranges":[">= 1.0.0, < 1.18.0"]}],"null_published_at":"2026-11-02T10:00:37.213Z","source_updated_at":"2026-09-01T18:41:48.000Z","source_disclosed_at":"2026-07-20T22:37:31.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:21:50.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}