CVE-2026-101900: Axios Fetch Adapter Header Injection Vulnerability
Summary
CVE-2026-101900: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders. Affects axios versions >= 1.12.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular promise-based HTTP client for JavaScript, widely used for making HTTP requests in both browser and Node.js environments. It simplifies the process of sending asynchronous requests and handling responses, providing features such as request and response interceptors, automatic JSON data transformation, and support for various request types. However, it is vulnerable to a header injection issue in its fetch adapter, which can be exploited if the Object prototype is polluted.
Vulnerability Detail
The vulnerability arises from the lack of a guard in the fetch adapter's configuration path, specifically in the resolveConfig() helper function. This allows an attacker to inject arbitrary headers into outgoing requests if they can manipulate the Object prototype to include FormData-like properties. The impact of this vulnerability can vary, potentially affecting authorization, metadata access, and other application-specific header logic. The issue is particularly concerning for applications that rely on the fetch adapter and may be running in an environment where prototype pollution is possible.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, use the Node HTTP adapter for server-side requests that may run in a polluted process. Avoid passing array or class-instance bodies through the fetch adapter when prototype pollution is suspected. Here is an example of how to use the Node HTTP adapter:
const axios = require('axios');
axios.post(url, data, { adapter: 'http' });
Conclusion
The Axios fetch adapter header injection vulnerability (CVE-2026-101900) poses a significant risk to applications using the library in environments susceptible to prototype pollution. It is crucial for developers to update to the latest version of Axios to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for axios →
FAQ
CVE-2026-101900 is a vulnerability in the Axios library that allows for header injection via the fetch adapter due to a lack of proper guards against prototype pollution.
If your application uses Axios version 1.17.0 to 1.19.9 and employs the fetch adapter, it may be vulnerable. You can check your application's dependencies using tools like Vulert.
An attacker could inject malicious headers into requests, potentially affecting authorization, metadata access, and other critical application functionalities.
You can update Axios to the patched version by running the command: npm install axios@^1.20.0 in your project directory.
As a temporary measure, switch to using the Node HTTP adapter for requests and avoid using the fetch adapter until you can update to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
