Copyright © 2012 Red Hat, Inc. All rights reserved.
Low
2026-08-01T12:22:18
axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-915
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases (axios.get(), axios.delete(), axios.head(), axios.options()), inherited data is read via (config || {}).data before config normalization, causing an attacker-controlled body to be sent on requests that did not set one. Additional low-level paths, only reachable when calling exported adapters/helpers (e.g. lib/adapters/http.js, unsafe/helpers/resolveConfig.js) directly with plain configs and no own proxy or paramsSerializer, can inherit polluted proxy values (routing requests through an attacker-controlled proxy) or paramsSerializer values (attacker-controlled URL serialization). These low-level gadgets do not reproduce through normal high-level axios calls on 1.15.2+. The issue is fixed in axios 1.18.0 and 0.33.0.
A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker injecting unauthorized data into requests that were not intended to have a body. In more advanced scenarios, an attacker could also redirect network traffic through their own malicious servers or manipulate how URLs are processed, potentially exposing sensitive information or allowing traffic modification.
Red Hat Hardened Images
2026-08-03T00:00:00Z
RHSA-2026:49714
grafana13-1-main-13.1.1-0.5.hum1
Red Hat Hardened Images
2026-08-05T00:00:00Z
RHSA-2026:50826
grafana13-1-main-13.1.1-0.5.2.hum1
Cryostat 4
Under investigation
axios
Cryostat 4
Under investigation
cryostat-openshift-console-plugin-npm
Gatekeeper 3
Under investigation
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Under investigation
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Under investigation
mta/mta-ui-rhel9
Migration Toolkit for Containers
Under investigation
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Under investigation
multicluster-engine/console-mce-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-pf4-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-rhel9
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Under investigation
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
rhacm2/console-rhel9
Red Hat Advanced Cluster Security 4
Under investigation
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Under investigation
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Under investigation
axios
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform/automation-dashboard-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
automation-controller
Red Hat Ansible Automation Platform 2
Fix deferred
automation-gateway
Red Hat Ansible Automation Platform 2
Fix deferred
automation-hub
Red Hat Ansible Automation Platform 2
Fix deferred
automation-platform-ui
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-galaxy-ng
Red Hat Ansible Automation Platform 2
Fix deferred
python-galaxy-ng
Red Hat build of Apache Camel for Spring Boot 4
Under investigation
axios
Red Hat build of Apache Camel - HawtIO 4
Under investigation
axios
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel9
Red Hat Data Grid 8
Under investigation
axios
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Under investigation
discovery/discovery-ui-rhel9
Red Hat Enterprise Linux 10
Fix deferred
ceph
Red Hat Enterprise Linux 10
Fix deferred
cockpit-image-builder
Red Hat Enterprise Linux 10
Fix deferred
grafana
Red Hat Enterprise Linux 10
Fix deferred
grafana-pcp
Red Hat Enterprise Linux 8
Fix deferred
grafana
Red Hat Enterprise Linux 8
Fix deferred
grafana-pcp
Red Hat Enterprise Linux 9
Fix deferred
grafana
Red Hat Enterprise Linux 9
Fix deferred
grafana-pcp
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
grafana12.4
Red Hat Hardened Images
Not affected
jaeger
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-monitoring-plugin-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/dashboard-rhel9
Red Hat OpenShift Virtualization 4
Under investigation
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Under investigation
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Under investigation
quay/quay-rhel8
Red Hat Quay 3
Under investigation
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-vulnerability-frontend-rhel9
Red Hat Trusted Artifact Signer
Under investigation
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Under investigation
rhtpa/rhtpa-trustification-service-rhel9
Red Hat Trusted Profile Analyzer
Under investigation
rhtpa/rhtpa-rhel10
Self-service automation portal 2
Under investigation
ansible-automation-platform/automation-portal
Self-service automation portal 2
Under investigation
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-67316
https://nvd.nist.gov/vuln/detail/CVE-2026-67316
https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx
https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods