Read the docs
TI-2026-65210 Aliases CVE-2026-101909GHSA-x97p-jq2g-jp4f

Axios: Prototype Pollution Gadget in axios toFormData Options

Priority HIGH 77CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00497 42nd percentileScored 2026-11-07
Fix Fixed axios (axios): 1.20.0, 0.34.0axios (npm): 0.34.0, 1.20.0Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
axiosaxios1.15.1 to before 1.20.0; 0.28.0 to before 0.34.01.20.0, 0.34.0Patch availableCNA
—axios (npm)0.28.0 to before 0.34.00.34.0Patch availableGHSA-x97p-jq2g-jp4f
—axios (npm)1.15.1 to before 1.20.01.20.0Patch availableGHSA-x97p-jq2g-jp4f
  • axios Vendoraxios Affected 1.15.1 to before 1.20.0; 0.28.0 to before 0.34.0 Fixed in 1.20.0, 0.34.0 Patch available CNA
  • axios (npm) Vendor— Affected 0.28.0 to before 0.34.0 Fixed in 0.34.0 Patch available GHSA-x97p-jq2g-jp4f
  • axios (npm) Vendor— Affected 1.15.1 to before 1.20.0 Fixed in 1.20.0 Patch available GHSA-x97p-jq2g-jp4f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:*——axios
  • cpe:2.3:a:axios:axios:*:*:*:*:*:*:*:* Versions — — ·axios

Remediation

  • Fix · CNA axios (axios) Fixed in 1.20.0, 0.34.0
  • Fix · GHSA-x97p-jq2g-jp4f axios (npm) Fixed in 0.34.0 Advisory →
  • Fix · GHSA-x97p-jq2g-jp4f axios (npm) Fixed in 1.20.0 Advisory →

Red Hat 3 advisories

  • RHSA-2026:74872 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.1-0.9.hum1@aarch64, grafana13.2-13.2.1-0.9.hum1@src, grafana13.2-13.2.1-0.9.hum1@x86_64
  • RHSA-2026:74871 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.12-0.3.hum1@aarch64, grafana12.4-12.4.12-0.3.hum1@src, grafana12.4-12.4.12-0.3.hum1@x86_64
  • RHSA-2026:74869 Released 2026-10-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.6-0.6.hum1@aarch64, grafana13.1-13.1.6-0.6.hum1@src, grafana13.1-13.1.6-0.6.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:74869, RHSA-2026:74871, RHSA-2026:74872
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101909
  2. 2026-10-03 Alias added: GHSA-x97p-jq2g-jp4f

References

Advisory 1

Other 7

  • TI-2026-30422 Server-side request forgery in axios CVSS 3.1CRITICAL 10.0
  • TI-2026-32427 Server-side request forgery in axios CVSS 3.1HIGH 8.6
  • TI-2026-65207 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location CVSS 4.0HIGH 8.2
  • TI-2026-65202 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization CVSS 4.0HIGH 8.2
  • TI-2026-65206 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection CVSS 4.0HIGH 7.6
  • TI-2026-30578 Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking CVSS 3.1CRITICAL 9.1
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences