Axios Prototype Pollution in HTTP Headers

Executive Summary

CVE-2026-101904 is a prototype pollution vulnerability in the Axios library affecting versions 1.0.0 to 1.20.0. It allows attackers to inject headers into HTTP requests by exploiting how Axios handles inherited properties from Object.prototype. When a request interceptor returns a config without an explicit headers property, Axios may resolve and use polluted headers from Object.prototype.headers.

Useful 0 Not Useful 0

Detection Guidance

Check if your Axios version is below 1.20.0 by running npm list axios or checking package.json. Review interceptor implementations to ensure they set an explicit headers property. Monitor for unexpected headers in requests or responses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to inject malicious headers into your HTTP requests, potentially bypassing authorization checks or manipulating cache behavior. It may impact routing logic, metadata services, or conditional requests in your application. The impact depends on how your application processes headers and handles requests.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized header injection, which may lead to improper handling of sensitive data. Attacker-controlled headers could manipulate authorization or routing logic, risking unauthorized access to protected information. The impact depends on how the application processes headers and whether intercepted requests involve regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Axios to version 1.20.0 or later. Ensure interceptors always set an own headers property or return the merged config object without rebuilding it. Review and sanitize any prototype pollution vulnerabilities in your application.

Useful 0 Not Useful 0