CVE-2026-101904

A flaw was found in Axios. If a separate vulnerability modifies shared object properties prototype pollution in the application environment, Axios may inherit those properties when processing request configurations rebuilt without explicit headers. An attacker can exploit this condition to inject...

CVE-2026-101902

A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same...

CVE-2026-101898

A flaw was found in axios. When processing HTTP/2 requests, the client fails to enforce configured proxy settings and custom Domain Name System DNS resolution policies. A remote attacker who can influence destination URLs could exploit this vulnerability to bypass outbound network restrictions,...

CVE-2026-101903

A flaw was found in Axios. A remote attacker can exploit this vulnerability by supplying a crafted data URL containing repeated slash characters to an application that processes untrusted inputs. Due to an inefficient regular expression used to parse the URL, handling the malformed input triggers...

CVE-2026-101906

A flaw was found in axios. A remote attacker operating a malicious server can cause a Denial of Service DoS by returning an HTTP redirect containing a crafted hostname. When proxy bypass settings are configured, the application processes the hostname with an inefficient regular expression that...

CVE-2026-101901

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1581 more potentially affected by CVE-2026-101909 via axios (>=0.28.0, <=0.33.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-101909 Source advisory: MEND:CVE-2026-101909...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +18207 more potentially affected by CVE-2026-101909 via axios (>=1.0.0, <=1.19.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-101909 Source advisory: MEND:CVE-2026-101909...

CVE-2026-101909

The Axios promise-based HTTP client (versions 0.28.0 to 0.34.0 and 1.15.1 to 1.20.0 ) contains a Prototype Pollution Gadget in the toFormData options. The vulnerability exists because ToFormData processes inherited serialization options and visitor properties. This allows an attacker who has alre...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101908

The Axios HTTP client (versions 1.7.0 through 1.20.0 ) contains a prototype pollution gadget within its fetch adapter . The vulnerability occurs because the adapter constructs a Request object using sanitized options but then invokes the fetch function using the original, unsanitized fetchOptions...

CVE-2026-101908 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

CVE-2026-101908 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

CVE-2026-101908

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +13595 more potentially affected by CVE-2026-101908 via axios (>=1.7.0, <=1.19.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-20251106131028, =1.0.53, =0.1.0, =1.0.0, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-101908 Source advisory: MEND:CVE-2026-101908...

CVE-2026-101908 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...