CVE-2026-101902 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within the Axios HTTP client library stems from an insecure handling of default method resolution when explicit parameters are omitted during request initialization. Axios, widely utilized for its promise-based interface in both browser and Node.js environments, relies on a default configuration object to determine standard behavior for requests that do not specify every parameter. Specifically, versions ranging from 0.27.2 up through 0.34.0 and the 1.x series up to 1.20.0 exhibit a flaw where the library attempts to read the method property directly from this default instance without first verifying if the property exists as an own property of that specific object. Instead, it traverses the prototype chain, inadvertently accessing inherited properties defined on Object.prototype. This design choice creates a critical dependency on the integrity of the global JavaScript environment, assuming that standard built-in objects remain unmodified by other code executing within the same process or browser context.
The technical core of this flaw is rooted in how modern JavaScript engines resolve property access when an object lacks its own definition for a given key. When a developer invokes axios.request with only a URL and no method specification, Axios checks its default configuration for a method value. If that specific instance does not have the method property defined directly on it, the lookup continues up the prototype chain to Object.prototype. Under normal circumstances, this would return undefined or a safe default, but if an attacker or another vulnerable module in the same application has polluted Object.prototype by adding a custom method property, Axios will inadvertently adopt that value. This is classified as a read-side gadget because Axios itself does not write to the prototype; it merely reads from it under specific conditions where explicit configuration is absent. The vulnerability allows for indirect control over HTTP request behavior through environmental manipulation rather than direct exploitation of Axios code logic alone.
The operational impact of this vulnerability is severe, particularly in applications that handle sensitive data or perform state-changing operations via API calls. By polluting Object.prototype with a method such as POST, PUT, DELETE, or PATCH, an attacker can force subsequent axios requests to use these destructive methods instead of the intended GET method. This effectively bypasses security controls that rely on HTTP method restrictions, such as Same-Origin Policy checks for certain actions or server-side logic expecting only read-only operations from specific endpoints. For instance, if a web application uses Axios to fetch user profile data via a GET request but fails to explicitly set the method in its configuration, and an injected script has polluted Object.prototype.method with POST, the browser will send a POST request instead. This can lead to unauthorized state changes, such as modifying database records or triggering administrative actions without proper authentication checks that might only apply to GET requests.
This issue aligns closely with CWE-1321: Improperly Controlled Modification of Object Prototype Attributes, specifically in the context of prototype pollution leading to unexpected behavior through property inheritance. From a tactical perspective, this vulnerability facilitates attacks described under MITRE ATT&CK technique T1564.008, which involves Hidden Files and Directories or more broadly T1222: File and Directory Permissions Modification if viewed as part of a broader exploitation chain where environmental state is manipulated to alter application behavior. The root cause lies in the lack of defensive programming practices regarding prototype chains, such as using Object.hasOwn() or checking for property existence before relying on inherited values. Developers must recognize that global object pollution can have cascading effects across all libraries and modules sharing the same execution context.
Mitigation strategies primarily involve upgrading to patched versions where this behavior has been corrected by ensuring methods are resolved safely without traversing unsafe prototype chains. For applications unable to upgrade immediately, developers should explicitly define the method property in every axios request configuration object, thereby preventing the lookup from reaching Object.prototype. Additionally, implementing strict Content Security Policy headers can help mitigate the risk of third-party scripts polluting the global scope by restricting script execution sources. It is also advisable for security teams to audit codebases for any instances where Axios requests are constructed without explicit method definitions, ensuring that all API calls clearly state their intended HTTP verb to eliminate ambiguity and prevent reliance on default inheritance mechanisms that can be hijacked through prototype pollution attacks.