CVE-2026-101900
— UNSCOREDpublic exploit availablePublished 2026-09-28 · Updated 2026-09-28
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.
Weaknesses
CWE-74, CWE-693, CWE-1321
Public exploit & PoC references
- https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- https://github.com/axios/axios/pull/11141
- https://github.com/axios/axios/releases/tag/v1.20.0
- https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
- https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
All references
- https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- https://github.com/axios/axios/pull/11141
- https://github.com/axios/axios/releases/tag/v1.20.0
- https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
- https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-101904PoC
- LOWCVE-2025-71424PoC
- MEDIUMCVE-2026-100312PoC
- HIGHCVE-2026-100314PoC
- HIGHCVE-2026-100315PoC
- HIGHCVE-2026-100676PoC
- HIGHCVE-2026-100739PoC
- HIGHCVE-2026-100874PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.