CVE-2026-101909 in Axios
Summary
by MITRE • 09/28/2026
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/28/2026
Axios serves as a widely adopted promise-based HTTP client for both browser environments and Node.js applications, facilitating data exchange between clients and servers. Within the version range spanning from 0.28.0 to 0.34.0, and subsequently from 1.15.1 to 1.20.0, a critical security flaw exists within the ToFormData utility function responsible for serializing JavaScript objects into multipart/form-data format. This vulnerability stems from improper handling of inherited properties on object prototypes during the serialization process. Specifically, when an attacker can influence or inject properties onto the prototype chain of an object passed to this function, those inherited properties are incorrectly processed as if they were own enumerable properties of the target object.
The technical mechanism behind this flaw involves the traversal of property descriptors without sufficient checks for ownership versus inheritance. In JavaScript, objects inherit properties from their prototypes unless explicitly filtered out during iteration or processing loops. The ToFormData implementation fails to distinguish between direct properties and those inherited through the prototype chain when extracting configuration options such as dots, indexes, metaTokens, maxDepth, visitor functions, and Blob values. Consequently, if an attacker manages to pollute the global Object.prototype or a relevant constructor's prototype with malicious key-value pairs, these injected attributes will be picked up by the serialization logic during subsequent HTTP requests made using Axios instances that utilize this form data transformation.
This prototype pollution leads to several distinct operational impacts depending on which inherited properties are manipulated. The alteration of field naming conventions and data interpretation can cause significant disruptions in how server-side applications parse incoming multipart forms, potentially leading to authentication bypasses or unauthorized access if the application relies on specific header structures or parameter names for security decisions. Furthermore, the manipulation of the maxDepth property allows an attacker to force request failures by setting depth limits that are too low for legitimate nested object serialization, resulting in denial-of-service conditions where valid API calls fail unexpectedly.
Additionally, the handling of Blob values can be altered through prototype pollution, changing how binary data is processed and transmitted, which may corrupt file uploads or cause unexpected behavior in applications expecting standard MIME types. Most critically, if a visitor function is injected into the prototype chain, it will execute during the serialization process for every subsequent request made by that Axios instance. While executing arbitrary code via a polluted visitor typically requires an attacker to already possess some level of control over object construction or injection points, this vulnerability lowers the barrier for exploitation in scenarios where user input directly influences object creation without proper sanitization. This aligns with CWE-1321 Improperly Controlled Modification of Object Prototype Attributes and is categorized under MITRE ATT&CK technique T1559 Inter-Process Communication via Shared Memory or similar patterns involving prototype manipulation, highlighting the risk to application integrity and availability.
To mitigate this vulnerability, organizations must immediately upgrade their Axios dependencies to version 0.34.0 or later for legacy branches, or version 1.20.0 and above for current releases where these issues have been resolved through stricter property enumeration checks that exclude inherited attributes from serialization logic. For applications unable to update immediately, implementing a defensive coding practice of freezing the Object.prototype is recommended to prevent runtime prototype pollution attacks across all JavaScript objects in the execution context. Additionally, developers should ensure that any user-supplied data used to construct objects passed to Axios functions undergoes rigorous validation and does not allow injection of reserved property names such as _proto_, constructor, or prototype. Regular security audits focusing on object manipulation patterns and dependency management will further reduce exposure to this class of vulnerabilities in modern web applications relying heavily on HTTP clients for communication.