CVE-2026-101900: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
Exploitation requires a separate same-process prototype-pollution flaw that lets an attacker provide an array or non-plain class instance with inherited properties. Plain objects are blocked.
Which request path is affected?
The issue affects requests made through Axios's fetch adapter when FormData headers are resolved. An inherited getHeaders function can supply attacker-controlled headers that are merged into the outgoing request.
What is the practical impact of injected headers?
Injected headers may alter authorization, caching, metadata-service interactions, or application-specific request behavior. The resulting impact depends on how the affected application uses Axios requests and interprets those headers.
What should teams do if they use an affected Axios release?
Upgrade Axios to version 1.20.0, which fixes the issue. Until upgrading, prioritize eliminating same-process prototype-pollution paths and avoid passing attacker-influenced non-plain objects or arrays into affected FormData handling.