Read the docs
TI-2026-47610 Aliases CVE-2026-67314GHSA-xj6q-8x83-jv6g

axios before 1.18.0 Prototype Pollution via auth subfields

Priority MEDIUM 61CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 22 fixed, 5 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00411 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial axios (axios): 1.18.0axios (npm): 1.18.0Red Hat: 28 advisoriesRed Hat: 22 fixed, 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.15.2 to before 1.18.01.18.0Patch availableCNA
—axios (npm)1.15.2 to before 1.18.01.18.0Patch availableGHSA-xj6q-8x83-jv6g
  • axios Vendoraxios Affected 1.15.2 to before 1.18.0 Fixed in 1.18.0 Patch available CNA
  • axios (npm) Vendor— Affected 1.15.2 to before 1.18.0 Fixed in 1.18.0 Patch available GHSA-xj6q-8x83-jv6g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*1.15.2 to before 1.18.0Vulnerableaxios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* Versions 1.15.2 to before 1.18.0 Vulnerable ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.18.0
  • Fix · GHSA-xj6q-8x83-jv6g axios (npm) Fixed in 1.18.0 Advisory →

Red Hat 28 advisories

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 25 more Red Hat advisories
  • RHSA-2026:81110 Released 2026-10-12 · Red Hat rating Important
    Red Hat Quay 3.18.1
    • Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68765 Released 2026-09-17 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:68755 Released 2026-09-17 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:68748 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68681 Released 2026-09-17 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.17 update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.11.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1
  • RHSA-2026:67711 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.10.8 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8
  • RHSA-2026:66523 Released 2026-09-10 · Red Hat rating Important
    Red Hat Quay 3.12.22
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:66084 Released 2026-09-09 · Red Hat rating Important
    Red Hat Quay 3.10.26
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:65514 Released 2026-09-08 · Red Hat rating Important
    Red Hat Quay 3.9.26
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:65118 Released 2026-09-08 · Red Hat rating Important
    Ansible plug-ins for Red Hat Developer Hub Product Release Update
    • Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:63373 Released 2026-09-03 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:63355 Released 2026-09-03 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:63307 Released 2026-09-03 · Red Hat rating Important
    Red Hat Quay 3.15.8
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:59583 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:59566 Released 2026-08-25 · Red Hat rating Important
    Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:50826 Released 2026-08-05 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.5.2.hum1@aarch64, grafana13.1-13.1.1-0.5.2.hum1@src, grafana13.1-13.1.1-0.5.2.hum1@x86_64
  • RHSA-2026:49714 Released 2026-08-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.5.hum1@aarch64, grafana13.1-13.1.1-0.5.hum1@src, grafana13.1-13.1.1-0.5.hum1@x86_64
  • RHSA-2026:48758 Released 2026-07-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.20.0-0.8.hum1@aarch64, jaeger-2.20.0-0.8.hum1@src, jaeger-2.20.0-0.8.hum1@x86_64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    axios 1.18.0

    10 records Highest priority Priority HIGH 3 HIGH, 5 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-47617 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassPriority HIGH 70
    • TI-2026-47614 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2Priority HIGH 67
    • TI-2026-47609 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONPriority HIGH 67
    Show all 10 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:67714
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:67711
Red Hat Ansible Automation Platform 2.1Fixed RHSA-2026:65118
Red Hat Hardened ImagesFixed RHSA-2026:48758, RHSA-2026:49714, RHSA-2026:50826
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:68681
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:68754
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:59566
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:59583
Red Hat Quay 3.10Fixed RHSA-2026:66084
Red Hat Quay 3.12Fixed RHSA-2026:66523
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:63307
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.18Fixed RHSA-2026:81110
Red Hat Quay 3.9Fixed RHSA-2026:65514
Red Hat Satellite 6.18Fixed RHSA-2026:63373, RHSA-2026:68765
Red Hat Satellite 6.19Fixed RHSA-2026:63355, RHSA-2026:68748, RHSA-2026:68755
Not affected: 23 products
  • Migration Toolkit for Applications 8
  • Network Observability Operator
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat OpenShift Virtualization 4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.18
  • Red Hat Quay 3.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67314
  2. 2026-10-03 Alias added: GHSA-xj6q-8x83-jv6g
  3. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
  4. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  8. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  9. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  10. 2026-10-30 Affected versions changed · Red Hat
  11. 2026-10-30 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat
  12. 2026-10-31 Fix available: RHSA-2026:67711 · Red Hat
  13. 2026-10-31 Fix available: RHSA-2026:67714 · Red Hat
  14. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  15. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
  • TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
  • TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
  • TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences