THREAT OPS › Threat News › [NVD] CVE-2026-67320 — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such
[NVD] CVE-2026-67320 — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such
CVE-2026-67320 CVSS: None Published: 2026-08-01T13:17:02.217
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as {...config} or Object.assign({}, config) converts the
Indicators of compromise
- CVE-2026-67320cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67320