CVE-2026-101900 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified as CVE-2024-39338 affects Axios, a widely used promise-based HTTP client for both browser and Node.js environments. The flaw exists within the ResolveConfig function, which is responsible for processing configuration objects before they are passed to various adapters such as fetch or http. Specifically, in versions ranging from 1.12.0 up to but not including 1.20.0, this function incorrectly reads inherited properties like Symbol.toStringTag, append, and getHeaders when resolving FormData headers. This behavior creates a pathway for prototype pollution attacks where an attacker can inject malicious data into the configuration object that is then processed by Axios without proper validation of its origin or structure.
The technical mechanism behind this vulnerability relies on JavaScript's prototype chain inheritance. While plain objects are blocked from being treated as FormData-like, non-plain class instances and arrays are not subjected to the same strict checks. An attacker can supply an array or a custom object with inherited properties that mimic the interface of a FormData instance. By exploiting the fact that ResolveConfig inspects these inherited properties, specifically the getHeaders method, the attacker gains control over the headers returned by this function. Since Axios merges these returned headers into the final request configuration, any header values defined in the malicious prototype become part of the outgoing HTTP request.
This capability allows for significant operational impact as it enables unauthorized modification of critical HTTP headers. Attackers can manipulate authorization tokens to bypass authentication mechanisms or steal sensitive credentials if they are transmitted via standard auth headers. Furthermore, by altering cache-control directives, an attacker might influence caching behavior leading to information leakage or denial-of-service conditions through excessive resource consumption. In cloud-native environments where metadata services such as AWS Instance Metadata Service (IMDS) rely on specific header configurations for security and access control, manipulating these headers could potentially allow unauthorized access to instance metadata, exposing sensitive infrastructure details like IAM roles and credentials.
The vulnerability aligns with CWE-915 which describes Improper Modification of Objects During Prototyping, a common issue in JavaScript applications where prototype chains are exploited to inject unexpected properties or methods. From an offensive security perspective, this attack vector is consistent with ATT&CK technique T1078 Valid Accounts if used for unauthorized access, and potentially T1498 Network Denial of Service if the manipulated headers cause service degradation. The core issue stems from insufficient validation of object types during configuration resolution, allowing inherited methods to execute code or return data that was not intended by the application developer.
Mitigation strategies primarily involve upgrading Axios to version 1.20.0 or later where this flaw has been addressed through stricter type checking and isolation of prototype chains during header processing. For applications unable to upgrade immediately, developers should implement additional validation layers around configuration objects passed to Axios methods, ensuring that only plain objects are accepted for certain operations. Additionally, using Content Security Policy headers can help mitigate some downstream impacts by restricting where scripts can load resources from, although this does not directly prevent the prototype pollution itself. Regular security audits focusing on how external data influences internal object structures are recommended to detect similar patterns in other parts of the codebase that may rely on dynamic property access without adequate safeguards against inherited method execution.