Notifications
Clear all
Topic starter
18/08/2026 2:41 pm
TL;DR: CVE-2026-67320 shows that an immutable request interceptor can re-expose polluted Object.prototype values in Axios Node.js HTTP traffic, allowing attacker-controlled proxying and plaintext request interception when another dependency has already polluted the process, according to Corgea. The bug turns a common config-cloning pattern into a governance problem for service credentials, outbound trust, and in-process hardening.
NHIMG editorial — based on content published by Corgea: Axios CVE-2026-67320 and Node.js request proxy exposure
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when a request interceptor clones hardened Axios config in Node.js services?
A: A plain-object clone can restore the default prototype chain after Axios has already hardened the merged config.
Q: Why do service clients with secrets become higher risk when prototype pollution is possible?
A: Because request objects often carry bearer tokens, Basic auth, cookies, and routing metadata in the same structure.
Q: How do security teams know whether Axios requests are still exposed to inherited proxy values?
A: Check whether any request middleware clones config into a plain object before dispatch, then validate whether the service uses the Node HTTP adapter and accepts inputs from other vulnerable packages.
Practitioner guidance
- Inventory vulnerable Axios versions and usage paths Find all instances of axios in Node.js services, then identify which code paths use the HTTP adapter, return cloned configs, or handle secret-bearing requests.
- Eliminate plain-object config cloning in interceptors Replace spread syntax and Object.assign patterns in request interceptors with safe updates that preserve the original hardened config or use a null-prototype clone.
- Restrict outbound proxy trust to explicit own properties Require own-property checks for proxy settings in security-sensitive clients, and set proxy: false where proxy support is unnecessary.
What's in the full report
Corgea's full article covers the code-level detail this post intentionally leaves for the source:
- A line-by-line look at the mergeConfig, interceptor, and dispatch sequence that exposes the hardening gap.
- Proof-of-concept output showing how proxy routing can capture headers, bodies, and response content.
- Version-specific remediation guidance for the affected axios ranges and patch targets.
- Search patterns for locating risky interceptor code and plaintext Node.js request paths in real codebases.
👉 Read Corgea's analysis of Axios prototype pollution and Node.js proxy exposure →
Axios prototype pollution in Node.js services: what breaks?
Explore further
18/08/2026 3:25 pm
Prototype-pollution-to-proxy redirection is the real failure mode here: the issue is not abstract object corruption, it is the loss of a hardening invariant between merge and dispatch. Security teams often assume that a null-prototype merge is enough, but later object cloning can silently restore the prototype chain. Practitioners should treat object reconstruction in request middleware as part of the control surface, not just application style.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: Who is accountable when a dependency chain turns outbound traffic into a secret leak?
A: Accountability is shared across application engineering, AppSec, and identity governance because the failure spans code, dependency management, and credential handling. The engineering team owns the middleware pattern, AppSec owns detection and testing, and identity teams own the impact on secrets, service accounts, and outbound trust policy.
👉 Read our full editorial: Axios prototype pollution can expose Node.js request traffic
