CVE-2026-101900: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Published Sep 28, 2026
·
Updated

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

Affected Software

1 affected component
npm/axios>=1.12.0<1.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Axios to a version that resolves this vulnerability.

    Fixed in 1.20.0

Event History

Sep 28, 2026
CVE Published
via MITRE·05:14 PM
Data Sourced
via MITRE·05:14 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What must an attacker control to exploit this issue?

Exploitation requires a separate same-process prototype-pollution flaw that lets an attacker provide an array or non-plain class instance with inherited properties. Plain objects are blocked.

2

Which request path is affected?

The issue affects requests made through Axios's fetch adapter when FormData headers are resolved. An inherited getHeaders function can supply attacker-controlled headers that are merged into the outgoing request.

3

What is the practical impact of injected headers?

Injected headers may alter authorization, caching, metadata-service interactions, or application-specific request behavior. The resulting impact depends on how the affected application uses Axios requests and interprets those headers.

4

What should teams do if they use an affected Axios release?

Upgrade Axios to version 1.20.0, which fixes the issue. Until upgrading, prioritize eliminating same-process prototype-pollution paths and avoid passing attacker-influenced non-plain objects or arrays into affected FormData handling.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203