CVE-2026-101900
Received Received - Intake

Axios Prototype Pollution in FormData Header Resolution

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101900
EUVD
EUVD-2026-88368

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
axios axios From 1.12.0 (inc) to 1.20.0 (inc)
axios axios to 1.20.0 (inc)
axios axios 1.20.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Axios library versions 1.12.0 to 1.20.0. It involves a prototype pollution flaw where inherited properties like Symbol.toStringTag and getHeaders are read while resolving FormData headers. An attacker can supply an array or non-plain class instance to make it appear FormData-like, then inject attacker-controlled headers via the getHeaders function. These headers are merged into fetch adapter requests, potentially altering request behavior such as authorization or cache handling.

Detection Guidance

Check if your system uses Axios versions between 1.12.0 and 1.20.0. Run: npm list axios or node -e "console.log(require('axios/package.json').version)". If vulnerable, update to 1.20.0 or later.

Impact Analysis

This vulnerability allows an attacker to inject arbitrary headers into HTTP requests made by Axios. This could lead to unauthorized access, manipulation of request behavior, or bypassing security controls by altering authorization, cache, or metadata-service headers. The impact is limited to users of the fetch adapter with a request body that is an array or non-plain class instance.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized header injection in HTTP requests. Attacker-controlled headers might alter authorization or metadata handling, which could lead to unauthorized data access or exposure. However, the specific impact depends on how the application uses Axios and whether sensitive data is transmitted.

Mitigation Strategies

Upgrade Axios to version 1.20.0 or higher immediately. If upgrading is not possible, avoid using the fetch adapter with request bodies that are arrays or non-plain class instances.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart