Axios: Prototype Pollution Gadget in axios toFormData Options

Summary Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and...

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options

NPM: Axios: Prototype Pollution Gadget in axios toFormData Options vulnerability discovered by ? in WordPress Npm axios versions = 0.28.0, 0.34.0...

EUVD-2026-88392

Axios: Prototype Pollution Gadget in axios toFormData Options...

Linux Distros Unpatched Vulnerability : CVE-2026-101909

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization...

DEBIAN-CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

UBUNTU-CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909

The Axios promise-based HTTP client (versions 0.28.0 to 0.34.0 and 1.15.1 to 1.20.0 ) contains a Prototype Pollution Gadget in the toFormData options. The vulnerability exists because ToFormData processes inherited serialization options and visitor properties. This allows an attacker who has alre...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

CVE-2026-101909: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited...

PT-2026-99952

Name of the Vulnerable Software and Affected Versions Axios versions 0.28.0 through 0.33.x Axios versions 1.15.1 through 1.19.x Description ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution, a condition where an attacker can manipulat...

Node.js Module axios 0.31.1 < 0.33.0 / 1.15.1 < 1.18.0 DoS (CVE-2026-67321)

The version of the axios Node.js module installed on the remote host is 0.31.1 prior to 0.33.0 or 1.15.1 prior to 1.18.0. It is, therefore, affected by a vulnerability: - An incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who...

CVE-2026-67321 axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a...

EUVD-2026-51812

axios before 0.33.0 contains an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in ''. Attackers who control object keys and nested values passed to axios form or parameter serialization can trigger a RangeError from JSON.stringify, causing denia...

Uncontrolled Recursion

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in , before the...

axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data

A flaw was found in Axios, a promise-based HTTP client for browsers and Node.js. This vulnerability occurs because the toFormData function recursively processes nested objects without a depth limit. A remote attacker can exploit this by sending deeply nested request data, which causes the Node.js...