CVE-2026-67314 (MEDIUM): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-67314	MEDIUM	axios	1.16.1	1.18.0	2026-08-01T13:17:01.407Z	2026-08-08T10:18:25.55754173Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:fb89526f1ccfe0df3ba952ae99e41df4494dd2cdc2a5dab7440708615ca2f78c
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:fb89526f1ccfe0df3ba952ae99e41df4494dd2cdc2a5dab7440708615ca2f78c
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:692043b6c7a8695a039aad9a177430396ad03b8374404e6110eee589c58447f6

---

Description

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth object that omits the username and/or password properties, axios reads the inherited Object.prototype.username and Object.prototype.password values and uses them to construct an outbound 'Authorization: Basic ...' header. axios itself does not pollute prototypes. The practical impact is outbound request tampering: an attacker who controls the polluted prototype values can inject attacker-chosen Basic auth credentials or replace an existing Authorization header. Credential disclosure is only possible under additional application-specific conditions.

---

Remediation Steps

• Update the affected package axios from version 1.16.1 to 1.18.0.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.