CVE-2026-101902 · GHSA-9fr6-4gfg-395g

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Risk score: 58/100
CVSS: 6.9 v4.0
Exploit chance (30 days): 0.4%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axio…
Affected: axios (npm) >= 0.27.2, < 0.34.0; axios (npm) >= 1.0.0, < 1.20.0
Fix: Upgrade axios to 0.34.0 or 1.20.0 (whichever matches your release line) or later.
Exploitation: Public proof of concept

Why it is Yellow

CVSS 6.9 medium
Public exploit or proof of concept referenced
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
axios	npm	>= 0.27.2, < 0.34.0	0.34.0
axios	npm	>= 1.0.0, < 1.20.0	1.20.0

References

Original description

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.