CVE-2026-101909: Axios: Prototype Pollution Gadget in axios toFormData Options
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.34.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.20.0
Event History
Frequently Asked Questions
Which Axios versions require remediation?
Affected releases are 0.28.0 through versions before 0.34.0, and 1.15.1 through versions before 1.20.0. Upgrade to 0.34.0 or 1.20.0, as appropriate for the maintained release line.
What must an attacker be able to do to exploit this issue?
An attacker needs a separate same-process prototype-pollution weakness that lets them supply inherited properties before Axios serializes an object. Execution through a polluted visitor additionally requires the stronger ability to inject a function.
How can teams assess whether an application is exposed?
Identify whether the application uses an affected Axios version and whether untrusted input can reach another prototype-pollution flaw in the same process before toFormData serialization. The relevant inherited properties include dots, indexes, metaTokens, maxDepth, visitor, and Blob.