NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

NPM: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests vulnerability discovered by ? in WordPress Npm axios versions = 1.7.0, 1.20.0...

EUVD-2026-88387

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests...

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

Malicious code in cdn-img-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7922ab741ba357d3d9bb14201acdffd89639cb0b7a8850180d6dd9a8266e9f7 On require of cdn-img-fetch, index.js unconditionally invokes https.get against https://raw.githubusercontent.com/cavecrew/proj/main/banner.png and...

MAL-2026-17320 Malicious code in cdn-img-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7922ab741ba357d3d9bb14201acdffd89639cb0b7a8850180d6dd9a8266e9f7 On require of cdn-img-fetch, index.js unconditionally invokes https.get against https://raw.githubusercontent.com/cavecrew/proj/main/banner.png and...

Linux Distros Unpatched Vulnerability : CVE-2026-101907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An...

Linux Distros Unpatched Vulnerability : CVE-2026-101908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101908

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

Cross-Site Request Forgery

Apache Wicket is vulnerable to cross-site request forgery. The vulnerability is due to unsafe allowances in the default FetchMetadataResourceIsolationPolicy, where any "simple top-level navigation" GET request is allowed regardless of Sec-Fetch-Site and Sec-Fetch-Mode, and Sec-Fetch-Site: same-si...

CVE-2026-101917

The PyJWT Python library (prior to version 2.14.0 ) is vulnerable to a denial-of-service vector due to how it handles unknown keys in the get_signing_key_from_jwt function. Because the library lacks a negative cache or minimum refresh interval, repeated requests using unknown or varying kid value...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are merged into the...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

CVE-2026-101908

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

CVE-2026-101907

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

CVE-2026-101900

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...