0xpay-cc-sdk (>=0.0.8, <=0.1.0), 0xtrails (>=0.0.0-20251106131028, <=0.19.1) +8477 more potentially affected by CVE-2026-101900 via axios (>=1.12.0, <=1.19.0)

axios NPM version =1.12.0, =0.0.8, =0.0.0-20251106131028, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.2.8 and more Source cves: CVE-2026-101900 Source advisory:...

EUVD-2026-88368

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders...

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...

GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...

0xpay-cc-sdk (>=0.0.8, <=0.1.0), 0xtrails (>=0.0.0-20251106131028, <=0.19.1) +8477 more potentially affected by CVE-2026-101900 via axios (>=1.12.0, <=1.19.0)

axios NPM version =1.12.0, =0.0.8, =0.0.0-20251106131028, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.2.8 and more Source cves: CVE-2026-101900 Source advisory:...

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +4097 more potentially affected by CVE-2026-101905 via axios (>=1.15.2, <=1.19.0)

axios NPM version =1.15.2, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =1.2.3 and mo...

EUVD-2026-88382

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection...

GHSA-M8M8-QJ5V-23W3 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

Summary Axios' Node HTTP adapter can act as a read-side prototype-pollution gadget for Node's sensitive createConnection request option. The adapter creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +4097 more potentially affected by CVE-2026-101905 via axios (>=1.15.2, <=1.19.0)

axios NPM version =1.15.2, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =1.2.3 and mo...

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

NPM: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection vulnerability discovered by ? in WordPress Npm axios versions = 1.15.2, 1.20.0...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

GHSA-44G4-M2MJ-WPVX Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Improper Isolation or Compartmentalization

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for CIDR notation, so...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 123pancli (1.0.0) +6028 more potentially affected by CVE-2026-101899 via axios (>=1.15.0, <=1.19.0)

axios NPM version =1.15.0, =0.0.0-20251106131028, =1.0.0, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =0.0.1-alpha.25 an...

NPM: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

NPM: Axios: CIDR-form NOPROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

0xtrails (>=0.0.0-20251106131028, <=0.19.1), 1inch-agent-kit (1.0.53) +3092 more potentially affected by CVE-2026-101907 via axios (>=1.17.0, <=1.19.0)

axios NPM version =1.17.0, =0.0.0-20251106131028, =0.0.0-develop-20260120180031, =8.13.1-beta.0, =6.13.1-beta-bump-deps.0, =0.0.0-canary-847463221a9a1bee28641d8c0ecfaca98ee142f6, =0.2.0, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.2.2-rc.0, =1.2.3 -...