CVE-2026-101904: Axios: Header Injection via Inherited headers After Minimal Interceptor
Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values. This issue is fixed in version 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Which Axios versions need remediation?
Axios versions from 1.0.0 up to, but not including, 1.20.0 are affected. The issue is fixed in Axios 1.20.0.
What conditions are required for exploitation?
An attacker must first be able to trigger a separate prototype-pollution issue in the same process that sets Object.prototype.headers. A trusted request interceptor must also return a new ordinary request configuration that does not have its own headers property.
What should teams review to determine exposure?
Review whether the application uses an affected Axios version, has any same-process prototype-pollution path, and uses request interceptors that replace the request configuration without defining an own headers property. Under those conditions, downstream request handling may receive attacker-controlled headers, including authorization-related values.
What is the available remediation?
Upgrade Axios to version 1.20.0. The provided information does not identify a separate configuration-only workaround.