CVE-2026-101905: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Which deployments are exposed in practice?
Exposure is limited to Axios use through its Node HTTP adapter. An affected process must also have a separate same-process prototype-pollution condition that can place a function on Object.prototype.createConnection.
What capability does an attacker need before this can be exploited?
The attacker needs a way to trigger prototype pollution in the same Node.js process and assign an attacker-controlled function to Object.prototype.createConnection. Without that prerequisite, the inherited socket-factory path described here is not available.
How can I determine whether an application may already be at risk?
Check whether the application uses Axios versions from 1.15.2 up to, but not including, 1.20.0 through the Node HTTP adapter. Also investigate whether any dependency or application input path can pollute Object.prototype, particularly with a createConnection property.
What should be done if an immediate Axios upgrade is not possible?
Prioritize eliminating or blocking the separate prototype-pollution condition in the same process, since it is required for exploitation. Ensure Object.prototype cannot acquire an attacker-controlled createConnection function, then upgrade Axios to 1.20.0 when possible.