CVE-2026-101907 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within Axios versions ranging from 1.17.0 to 1.20.0 represents a significant deviation from expected HTTP client behavior regarding redirect handling, specifically when utilizing the fetch adapter. Axios is widely adopted as a promise-based HTTP client for both browser environments and Node.js applications, serving as a critical component in many modern web architectures. The core issue arises from an inconsistency between the library's configuration parameters and the underlying native implementation of the Fetch API. When developers explicitly configure an Axios request with maxRedirects set to zero, they are signaling a strict policy that no automatic redirection should occur. This setting is typically employed by security-conscious applications to prevent open redirect vulnerabilities or to ensure that requests remain within expected boundaries without following external hops.
In this flawed implementation, the fetch adapter fails to respect the maxRedirects: 0 directive when it encounters an HTTP response containing a redirect status code, such as 301 Moved Permanently or 302 Found. Instead of halting execution and returning the raw redirect response to the caller for manual handling, the underlying fetch implementation automatically follows the Location header provided in the response headers. This behavior effectively bypasses the security control intended by the developer's configuration. The technical flaw lies in the adapter not intercepting or blocking the automatic redirection mechanism inherent to the native Fetch API when the zero-redirect policy is active. Consequently, the request proceeds to the new URL without any indication that a redirect occurred, violating the principle of least surprise and undermining explicit security configurations.
The operational impact of this vulnerability can be severe depending on the context in which Axios is deployed. If an application relies on maxRedirects: 0 to prevent access to internal services or sensitive endpoints located behind redirects, this flaw allows attackers to bypass those restrictions. For instance, if a server responds with a redirect pointing to an internal administrative endpoint or a state-changing API that should not be accessible from the client side, Axios will silently follow it. This can lead to unauthorized data exposure where internal responses become visible to external actors. Furthermore, in scenarios involving authentication flows or session management, following redirects unexpectedly could result in token leakage or session hijacking if the redirect points to an untrusted domain. The ability to reach state-changing internal endpoints despite explicit restrictions increases the attack surface for remote code execution or privilege escalation attacks that rely on manipulating request destinations through server-side response manipulation.
From a classification perspective, this vulnerability aligns with CWE-601, URL Redirection to Untrusted Site (Open Redirect), although it is exacerbated by the failure of security controls intended to mitigate such risks. It also relates to CWE-209, Generation of Error Message Containing Sensitive Information, if the redirect leads to endpoints that return detailed error messages about internal system states. In terms of offensive tactics, this behavior can be leveraged within the ATT&CK framework under techniques related to Command and Control or Defense Evasion, specifically where an attacker uses redirections to bypass network security controls or application logic restrictions. The failure to enforce configured limits is a form of improper input validation regarding internal configuration parameters, allowing external inputs (redirect responses) to dictate control flow in violation of policy.
To mitigate this vulnerability, organizations must immediately upgrade their Axios dependencies to version 1.20.0 or later, where the fetch adapter has been corrected to properly respect the maxRedirects setting. For applications that cannot update immediately due to compatibility constraints, a temporary workaround involves avoiding the use of the fetch adapter in environments where strict redirect control is required. Developers should consider using alternative adapters such as the Node.js http adapter for server-side operations or implementing custom interceptors to manually handle and block redirects when maxRedirects is set to zero. Additionally, security teams should audit existing codebases for instances relying on this specific configuration to ensure that no critical logic depends on the assumption that redirects are strictly blocked in these versions. Regular dependency scanning and adherence to secure coding standards that validate not just user input but also library behavior against expected configurations are essential practices to prevent similar issues in future deployments.