CVE-2026-101905: Axios Node HTTP Adapter Prototype Pollution Vulnerability

Background

Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library is widely adopted due to its promise-based API, ease of use, and ability to handle requests and responses in a streamlined manner. However, a recent vulnerability has been identified in its Node HTTP adapter, which can lead to serious security issues if exploited.

Vulnerability Detail

The vulnerability arises from Axios' Node HTTP adapter acting as a read-side prototype-pollution gadget. It creates a null-prototype options object, but Node's HTTP client can copy or normalize request options into ordinary objects before connection creation. If the Object.prototype.createConnection has been polluted elsewhere in the same process, Node can call the inherited function, allowing an attacker to hijack the request socket and redirect it to a malicious endpoint. This can lead to credential exfiltration, response manipulation, and bypassing application validation checks.

npm install axios@1.20.0

Workaround

As a temporary workaround, you can run Axios in a process where prototype pollution is not present. Alternatively, you can implement a custom trusted transport or agent layer that sets and enforces its own connection creation behavior. Here is an example of how to set an own safe value for createConnection in the Axios request options:

const options = Object.assign(Object.create(null), {
  path,
  method,
  headers,
  agents: { http: httpAgent, https: httpsAgent },
  auth,
  protocol,
  family,
  beforeRedirect: dispatchBeforeRedirect,
  beforeRedirects: Object.create(null),
  http2Options,
  createConnection: undefined,
});

Conclusion

The Axios Node HTTP adapter vulnerability (CVE-2026-101905) poses a significant risk due to its potential for prototype pollution, allowing attackers to hijack request sockets. It is crucial to update to the patched version or implement workarounds to safeguard your application from exploitation.

See every vulnerability recorded for axios →

FAQ