CVE-2026-101909 · GHSA-x97p-jq2g-jp4f
Axios: Prototype Pollution Gadget in axios toFormData Options
- Risk score
- 70/100
- CVSS
- 8.3 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTo…
- Affected
- axios (npm) >= 0.28.0, < 0.34.0; axios (npm) >= 1.15.1, < 1.20.0
- Fix
- Upgrade axios to 0.34.0 or 1.20.0 (whichever matches your release line) or later.
- Exploitation
- Public proof of concept
Story map
At a glance
axios: Amber, patch this week. Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Locat…
The flaws
- CVE-2026-101909: Axios: Prototype Pollution Gadget in axios toFormData Options (CVSS 8.3 · EPSS 0%)
- CVE-2026-101906: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location (CVSS 8.2 · EPSS 0%)
- CVE-2026-101901: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization (CVSS 8.2 · EPSS 0%)
- CVE-2026-101903: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) (CVSS 8.2 · EPSS 0%)
The fix
Upgrade axios: 0.34.0 · 1.20.0 or later on your release line
Who is exposed: axios (npm) >= 1.15.0, < 1.20.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Prototype pollution (CWE-1321). 40 other warnings in 30 days
Why it is Amber
- CVSS 8.3 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| axios | npm | >= 0.28.0, < 0.34.0 | 0.34.0 |
| axios | npm | >= 1.15.1, < 1.20.0 | 1.20.0 |
References
- https://github.com/advisories/GHSA-x97p-jq2g-jp4f
- https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f
- https://nvd.nist.gov/vuln/detail/CVE-2026-101909
- https://github.com/axios/axios/pull/11141
- https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b
- https://github.com/axios/axios/releases/tag/v0.34.0
- https://github.com/axios/axios/releases/tag/v1.20.0
- https://github.com/advisories/GHSA-x97p-jq2g-jp4f
Original description
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.
Last activity 28 Sep 2026. Patch Forecast updates every hour.