CVE-2026-101909: Axios: Prototype Pollution Gadget in axios toFormData Options

Published Sep 28, 2026
·
Updated

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.

Affected Software

1 affected component
npm/axios>=0.28.0<0.34.0, >=1.15.1<1.20.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade axios to a version that resolves this vulnerability.

    Fixed in 0.34.0
  2. Upgrade

    Upgrade axios to a version that resolves this vulnerability.

    Fixed in 1.20.0

Event History

Sep 28, 2026
CVE Published
via MITRE·05:42 PM
Data Sourced
via MITRE·05:42 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which Axios versions require remediation?

Affected releases are 0.28.0 through versions before 0.34.0, and 1.15.1 through versions before 1.20.0. Upgrade to 0.34.0 or 1.20.0, as appropriate for the maintained release line.

2

What must an attacker be able to do to exploit this issue?

An attacker needs a separate same-process prototype-pollution weakness that lets them supply inherited properties before Axios serializes an object. Execution through a polluted visitor additionally requires the stronger ability to inject a function.

3

How can teams assess whether an application is exposed?

Identify whether the application uses an affected Axios version and whether untrusted input can reach another prototype-pollution flaw in the same process before toFormData serialization. The relevant inherited properties include dots, indexes, metaTokens, maxDepth, visitor, and Blob.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203