CVE-2026-101908 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within Axios versions ranging from 1.7.0 through 1.20.0 represents a critical security flaw rooted in the interaction between JavaScript prototype pollution and HTTP request construction mechanisms. Axios, widely utilized as a promise-based HTTP client for both browser environments and Node.js applications, relies on an adapter pattern to handle network requests. In this specific instance, the fetch adapter is responsible for translating internal configuration options into actual HTTP requests using the native Fetch API. The core technical flaw arises from a discrepancy in how request headers are processed during the construction of the Request object versus their application during the execution of the fetch call. Specifically, while the code attempts to sanitize resolvedOptions before passing them to the Request constructor, it subsequently passes the original, unsanitized fetchOptions as the second argument to the fetch function. This architectural inconsistency creates a window for header injection and manipulation by malicious actors.
The exploitation vector is significantly amplified by a separate prototype pollution vulnerability within the same process context. An attacker who can control or influence object properties in the global scope may populate Object.prototype.headers with arbitrary values. Because JavaScript resolves property access through the prototype chain, any fetchOptions object that does not explicitly define its own headers property will inherit these maliciously injected headers from Object.prototype. When the axios library processes a request, it constructs a Request instance using sanitized options to set initial header states. However, when the actual network call is initiated via the native fetch API, the unsanitized fetchOptions are passed along. The inherited headers from the polluted prototype override or merge with the sanitized headers established during Request construction. This mechanism allows an attacker to inject arbitrary HTTP headers into outgoing requests without directly modifying the immediate request configuration object, effectively bypassing intended security controls and sanitization logic implemented by the library developers.
The operational impact of this vulnerability is severe due to its potential to alter critical aspects of network communication. By injecting custom headers, an attacker can manipulate authorization mechanisms, potentially leading to unauthorized access if authentication tokens or credentials are improperly handled in downstream services that trust these injected values. Furthermore, the ability to modify caching-related headers such as Cache-Control or Vary can disrupt application logic and lead to cache poisoning attacks, where malicious content is served to other users based on manipulated response behaviors. In cloud-native environments, this flaw poses a significant risk regarding metadata-service access. Attackers may inject headers that influence routing or proxy behavior, potentially facilitating unauthorized retrieval of sensitive instance metadata from cloud providers like AWS EC2 or Google Cloud Platform. Additionally, application-specific logic that relies on custom HTTP headers for feature toggles, A/B testing, or security policies can be subverted, leading to unexpected behaviors and potential data integrity issues across the affected system.
To mitigate this vulnerability, organizations must immediately upgrade Axios to version 1.20.0 or later, where the fetch adapter logic has been corrected to ensure that sanitized options are consistently applied during both Request construction and execution phases. For environments unable to update immediately, implementing strict input validation on all user-supplied data that influences object properties can help prevent prototype pollution attacks at the application level. Developers should also avoid relying solely on library-level sanitization for security-critical headers such as Authorization or Content-Type, instead enforcing these values explicitly within the request configuration before transmission. Regular dependency audits and monitoring for known vulnerabilities in third-party libraries are essential practices to maintain a secure software supply chain. The technical classification of this issue aligns with CWE-1321: Improperly Controlled Modification of Object Prototype Attributes, commonly referred to as JavaScript Prototype Pollution, which facilitates the header injection described here. In terms of offensive security frameworks, this vulnerability can be leveraged in attacks categorized under MITRE ATT&CK techniques related to Command and Scripting Interpreter or potentially Taint Checking if it leads to broader system compromise through metadata exfiltration.