DEBIAN-CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.
DEBIAN-CVE-2026-67319
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-67319
node-axios
Source reference: /affected/0/package/name
- Affected versions
- 1.11.0+dfsg-1
Source reference:
/affected/0/versions1.12.1+dfsg-1Source reference:
/affected/0/versions1.13.1+dfsg-1Source reference:
/affected/0/versions1.13.2+dfsg-1Source reference:
/affected/0/versions1.14.0+dfsg-1Source reference:
/affected/0/versions1.15.0-1Source reference:
/affected/0/versions1.15.2-1Source reference:
/affected/0/versions1.16.0-1Source reference:
/affected/0/versions1.18.0-1Source reference:
/affected/0/versions1.19.0-1Source reference:
/affected/0/versions1.2.1+dfsg-1Source reference:
/affected/0/versions1.2.1+dfsg-1+deb12u1Source reference:
/affected/0/versions1.20.0-1Source reference:
/affected/0/versions1.5.1+dfsg-1Source reference:
/affected/0/versions1.6.2+dfsg-1Source reference:
/affected/0/versions1.6.8+dfsg-1Source reference:
/affected/0/versions1.6.8+dfsg-2Source reference:
/affected/0/versions1.7.3+dfsg-1Source reference:
/affected/0/versions1.7.4+dfsg-1Source reference:
/affected/0/versions1.7.7+dfsg-1Source reference:
/affected/0/versions1.7.9+dfsg-1Source reference:
/affected/0/versions1.8.4+dfsg-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
node-axios
Source reference: /affected/1/package/name
- Affected versions
- 1.11.0+dfsg-1
Source reference:
/affected/1/versions1.12.1+dfsg-1Source reference:
/affected/1/versions1.13.1+dfsg-1Source reference:
/affected/1/versions1.13.2+dfsg-1Source reference:
/affected/1/versions1.14.0+dfsg-1Source reference:
/affected/1/versions1.15.0-1Source reference:
/affected/1/versions1.15.2-1Source reference:
/affected/1/versions1.16.0-1Source reference:
/affected/1/versions1.18.0-1Source reference:
/affected/1/versions1.19.0-1Source reference:
/affected/1/versions1.20.0-1Source reference:
/affected/1/versions1.8.4+dfsg-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
node-axios
Source reference: /affected/2/package/name
- Affected versions
- 1.11.0+dfsg-1
Source reference:
/affected/2/versions1.12.1+dfsg-1Source reference:
/affected/2/versions1.13.1+dfsg-1Source reference:
/affected/2/versions1.13.2+dfsg-1Source reference:
/affected/2/versions1.14.0+dfsg-1Source reference:
/affected/2/versions1.15.0-1Source reference:
/affected/2/versions1.15.2-1Source reference:
/affected/2/versions1.16.0-1Source reference:
/affected/2/versions1.8.4+dfsg-1Source reference:
/affected/2/versions - Fixed versions
- 1.18.0-1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-axios",
"purl": "pkg:deb/debian/node-axios?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.11.0+dfsg-1",
"1.12.1+dfsg-1",
"1.13.1+dfsg-1",
"1.13.2+dfsg-1",
"1.14.0+dfsg-1",
"1.15.0-1",
"1.15.2-1",
"1.16.0-1",
"1.18.0-1",
"1.19.0-1",
"1.2.1+dfsg-1",
"1.2.1+dfsg-1+deb12u1",
"1.20.0-1",
"1.5.1+dfsg-1",
"1.6.2+dfsg-1",
"1.6.8+dfsg-1",
"1.6.8+dfsg-2",
"1.7.3+dfsg-1",
"1.7.4+dfsg-1",
"1.7.7+dfsg-1",
"1.7.9+dfsg-1",
"1.8.4+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67319.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-axios",
"purl": "pkg:deb/debian/node-axios?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1.11.0+dfsg-1",
"1.12.1+dfsg-1",
"1.13.1+dfsg-1",
"1.13.2+dfsg-1",
"1.14.0+dfsg-1",
"1.15.0-1",
"1.15.2-1",
"1.16.0-1",
"1.18.0-1",
"1.19.0-1",
"1.20.0-1",
"1.8.4+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67319.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.18.0-1"
}
]
}
],
"package": {
"name": "node-axios",
"purl": "pkg:deb/debian/node-axios?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1.11.0+dfsg-1",
"1.12.1+dfsg-1",
"1.13.1+dfsg-1",
"1.13.2+dfsg-1",
"1.14.0+dfsg-1",
"1.15.0-1",
"1.15.2-1",
"1.16.0-1",
"1.8.4+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67319.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58296 · Revision 1
- Added to Heist Feed
- Publisher date