Bug 2510009 (CVE-2026-67316)
| Summary: | CVE-2026-67316 axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | aazores, abarbaro, abrianik, abuckta, akostadi, alizardo, amasferr, anthomas, aruklets, ataylor, bbrownin, brasmith, cmah, cmyers, cochase, dbosanac, dbruscin, dfreiber, dkeler, dkuc, dmayorov, dnakabaa, doconnor, dranck, drow, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, ehugonne, ewittman, fmariani, ggainey, ggrzybek, gmalinko, gparvin, ibolton, janstey, jburrell, jchui, jhe, jlanda, jlledo, jmatsuok, jmatthew, jmontleo, jpasqual, jraez, jreimann, jtolenti, juwatts, jwon, kaycoth, kshier, ktsao, kvanderr, lball, lchilton, lcouzens, mcarlett, mdellweg, mdessi, mhulan, mrizzi, nboldt, ngough, nipatil, nmoumoul, oaljalju, orabin, osousa, pantinor, parichar, pcattana, pcreech, pgaikwad, pjindal, prwatson, psrna, rchan, rhaigner, rhel-process-autobot, rjohnson, rkubis, rstepani, sdawley, sfeifer, simaishi, slucidi, smallamp, sseago, stcannon, suppawar, tasato, tcunning, teagle, thason, tmalecek, tsedmik, veshanka, vkumar, watson-tool-maintainers, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2510261, 2510262, 2510266, 2510269, 2510272, 2510273, 2510263, 2510264, 2510265, 2510267, 2510268, 2510270, 2510271 | ||
| Bug Blocks: | |||
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.