CVE-2026-67316 | axios prior 1.18.0/0.33.0 Request Construction/HTTP Adapter resolveConfig.js axios.get/axios.delete/axios.head/axios.options config.data/proxy/paramsSerializer prototype pollution (EUVD-2026-51827 / Nessus ID 331634)

A vulnerability marked as . This affects the function axios.get/axios.delete/axios.head/axios.options of the file lib/adapters/http.js/unsafe/helpers/resolveConfig.js of the component Request Construction/HTTP Adapter. The manipulation of the argument config.data/proxy/paramsSerializer leads to improperly controlled modification of object prototype attributes.

This vulnerability is uniquely identified as CVE-2026-67316. The attack is possible to be carried out remotely. No exploit exists.

It is suggested to upgrade the affected component.