Topic starter
18/08/2026 2:41 pm
TL;DR: CVE-2026-67320 shows that an immutable request interceptor can re-expose polluted Object.prototype values in Axios Node.js HTTP traffic, allowing attacker-controlled proxying and plaintext request interception when another dependency has already polluted the process, according to Corgea. The bug turns a common config-cloning pattern into a governance problem for service credentials, outbound trust, and in-process hardening.
Editorial analysis by NHI Mgmt Group, based on content published by Corgea: “CVE-2026-67320: Axios request interceptors can resurrect inherited proxy settings in Node.js”.
Key questions
Q: What breaks when a request interceptor clones hardened Axios config in Node.js services?
A: A plain-object clone can restore the default prototype chain after Axios has already hardened the merged config.
Q: Why does this Axios issue create real risk only after other prototype pollution exists?
A: Because the bug needs a polluted process to supply the malicious inherited value.
Q: What are the signs that Axios outbound traffic may be unsafe?
A: Look for Node.js services using the HTTP adapter, interceptors that return fresh config objects, unexpected proxy settings in request paths, and any dependency that can pollute Object.prototype.
Practitioner guidance
- Audit Axios interceptors for object-cloning patterns Look for spread syntax, Object.assign, or wrapper functions that return a fresh config object after Axios has hardened it.
- Pin and verify fixed Axios versions Upgrade affected Node.js services to axios 0.33.0 or 1.18.0 or later, then verify the resolved dependency tree across npm, pnpm, or yarn so transitive copies do not remain in place.
- Map Node HTTP adapter exposure Identify which services use Axios’s HTTP adapter and which still send plaintext HTTP traffic, then prioritise the ones that carry bearer tokens, Basic auth, or request bodies with sensitive data.
Bottom line: Axios prototype pollution matters here because a plain-object clone can undo a hardening step that was meant to keep inherited properties out of outbound request config.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Prototype pollution becomes a governance problem when a later extension point can restore the attack path. This case shows that hardening at merge time is not enough if interceptors, wrappers, or middleware can reintroduce ordinary object semantics before dispatch. The real control gap is not simply polluted input, but loss of the null-prototype invariant inside trusted application code. Practitioners should treat in-process object hardening as an end-to-end property, not a one-time merge step.
A question worth separating out:
Q: What should teams do immediately after discovering vulnerable Axios use?
A: Patch to a fixed Axios release, inventory affected services, and review whether secrets may have traversed plaintext HTTP during the exposure window. Then rotate credentials where request headers, auth fields, or bodies could have been observed by an attacker-controlled proxy.
👉 Read our full editorial: Axios prototype pollution can expose Node.js request traffic