CVE-2026-101904 Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

CVE-2026-101904 Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

CVE-2026-101904 Axios: Header Injection via Inherited headers After Minimal Interceptor

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

CVE-2026-101904

Axios is a promise-based HTTP client for the browser and Node.js. the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors...

CVE-2026-101904

The Axios promise-based HTTP client (versions 1.0.0 to 1.20.0 ) is vulnerable to a Header Injection flaw. The dispatchRequest function incorrectly normalizes inherited Object.prototype.headers when a replacement request configuration is used. If a separate same-process prototype pollution flaw se...

CVE-2026-101904

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

The Axios promise-based HTTP client (versions 0.27.2 until 0.34.0 and 1.20.0) contains a read-side prototype pollution gadget within its request dispatch logic. The vulnerability allows an attacker who has achieved prototype pollution elsewhere in the process to manipulate Object.prototype.method...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900

The Axios HTTP client (versions 1.12.0 to 1.20.0 ) is vulnerable to a Fetch Adapter Header Injection flaw. The issue occurs because ResolveConfig reads inherited properties—specifically Symbol.toStringTag, append, and getHeaders—while resolving FormData headers. This can be exploited via a separa...

CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

EUVD-2026-85327

scim-patch: Mutation of Inherited Built-in Method Objects...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in axios (CVE-2026-42264)

Summary A credential exposure vulnerability during HTTP redirects in the axios HTTP client library CVE-2026-42264 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise...