axios before 0.33.0 Prototype Pollution via Node HTTP adapter

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

No

Technical impact

Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• axios Vendoraxios Affected 0.31.1 to before 0.33.0 Fixed in 0.33.0 Patch available CNA
• axios Vendoraxios Affected 1.15.2 to before 1.18.0 Fixed in 1.18.0 Patch available CNA
• axios (npm) Vendor— Affected 0.31.1 to before 0.33.0 Fixed in 0.33.0 Patch available GHSA-gcfj-64vw-6mp9
• axios (npm) Vendor— Affected 1.15.2 to before 1.18.0 Fixed in 1.18.0 Patch available GHSA-gcfj-64vw-6mp9

• Fix · CNA axios (axios) Fixed in 0.33.0
• Fix · CNA axios (axios) Fixed in 1.18.0
• Fix · GHSA-gcfj-64vw-6mp9 axios (npm) Fixed in 0.33.0 Advisory →
• Fix · GHSA-gcfj-64vw-6mp9 axios (npm) Fixed in 1.18.0 Advisory →

Records fixed by the same vendor advisory or release, as the CNA lists them.

• Release · 2026-08-01

  axios 1.18.0

  10 records · Highest priority Priority HIGH · 3 HIGH, 5 MEDIUM, 2 LOW

  Other records, highest priority first

  • TI-2026-47617 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassPriority HIGH 70
  • TI-2026-47614 axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2Priority HIGH 67
  • TI-2026-47609 axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONPriority HIGH 67
  Show all 10 records →
• Release · 2026-08-01

  axios 0.33.0

  6 records · Highest priority Priority HIGH · 1 HIGH, 3 MEDIUM, 2 LOW

  Other records, highest priority first

  • TI-2026-47617 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassPriority HIGH 70
  • TI-2026-47615 axios before 0.33.0 Prototype Pollution via nested option objectsPriority MEDIUM 61
  • TI-2026-47612 axios before 1.18.0 Prototype Pollution via bodyless methodsPriority MEDIUM 61
  Show all 6 records →

1. 2026-10-02 Threatist record created from CVE-2026-67320
2. 2026-10-03 Alias added: GHSA-gcfj-64vw-6mp9
3. 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
4. 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
7. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
8. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
9. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
10. 2026-10-30 Affected versions changed · Red Hat
11. 2026-10-30 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat
12. 2026-10-31 Fix available: RHSA-2026:67711 · Red Hat
13. 2026-10-31 Fix available: RHSA-2026:67714 · Red Hat
14. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
15. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

• TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
• TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
• TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
• TI-2026-32428 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` CVSS 3.1HIGH 8.7
• TI-2025-20009 Possible SSRF and Credential Leakage via Absolute URL in axios Requests CVSS 4.0HIGH 7.7
• TI-2026-32430 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection CVSS 3.1HIGH 7.5

• CVE-2026-67320 · CVE Program
• CVE-2026-67320 · NVD
• FIRST EPSS
• GHSA-gcfj-64vw-6mp9 · GitHub Advisory Database · CC BY 4.0
• CVE-2026-67320 · Red Hat security data · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences