CVE-2026-101908 · GHSA-vh66-26gq-q6x8

Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Risk score: 58/100
CVSS: 6.9 v4.0
Exploit chance (30 days): 0.4%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.heade…
Affected: axios (npm) >= 1.7.0, < 1.20.0
Fix: Upgrade axios to 1.20.0 or later.
Exploitation: Public proof of concept

Why it is Yellow

CVSS 6.9 medium
Public exploit or proof of concept referenced
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
axios	npm	>= 1.7.0, < 1.20.0	1.20.0

References

Original description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.

Last activity 28 Sep 2026. Patch Forecast updates every hour.