CVE-2026-101900 · GHSA-4hqw-qxg8-jxx2

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Risk score: 60/100
CVSS: 6.9 v4.0
Exploit chance (30 days): 0.5%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherite…
Affected: axios (npm) >= 1.12.0, < 1.20.0
Fix: Upgrade axios to 1.20.0 or later.
Exploitation: Public proof of concept

Why it is Amber

CVSS 6.9 medium
Public exploit or proof of concept referenced
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
axios	npm	>= 1.12.0, < 1.20.0	1.20.0

References

Original description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.