CVE-2026-101904: Axios Header Injection via Inherited Headers After Minimal Interceptor
Summary
CVE-2026-101904: Axios: Header Injection via Inherited headers After Minimal Interceptor. Affects axios versions >= 1.0.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js. It provides a simple API for sending asynchronous requests and handling responses. Axios supports features like interceptors, which allow developers to modify requests or responses before they are handled. However, a vulnerability has been identified in Axios that can lead to header injection due to improper handling of inherited properties in certain configurations.
Vulnerability Detail
The vulnerability arises from Axios request interceptors that can return a replacement configuration object. If an interceptor returns a plain object without its own 'headers' property, the 'dispatchRequest()' function may evaluate 'config.headers' and inadvertently resolve an inherited 'Object.prototype.headers' value. This can allow an attacker, who has previously exploited a prototype pollution vulnerability, to inject malicious headers into Axios requests. The impact of this vulnerability can vary depending on the target service, potentially affecting cache behavior, authorization logic, and more.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, ensure that any request interceptors you implement preserve the 'headers' property. For example, modify your interceptor to include the existing headers:
client.interceptors.request.use((config) => ({
...config,
headers: config.headers || {}
}));
Conclusion
The Axios vulnerability CVE-2026-101904 highlights the importance of properly managing object properties in JavaScript, particularly when dealing with request interceptors. By updating to the latest version or implementing the recommended workarounds, developers can safeguard their applications against potential header injection attacks.
See every vulnerability recorded for axios →
FAQ
The vulnerability allows for header injection due to improper handling of inherited properties in Axios request interceptors.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Potential impacts include unauthorized header injection, which can affect cache behavior, authorization logic, and other application-specific functionalities.
Yes, the vulnerability has been patched in Axios version 1.20.0 and later.
Implement a workaround by ensuring that your interceptors preserve the 'headers' property to prevent the injection of inherited headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
