CVE-2026-101908: Axios Prototype Pollution Vulnerability in Fetch Adapter
Summary
CVE-2026-101908: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests. Affects axios versions >= 1.7.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests. It provides a simple API for sending asynchronous requests to REST endpoints and handling responses. The library is widely used in both client-side and server-side applications due to its ease of use and flexibility. However, a vulnerability has been identified in the fetch adapter of Axios, which can lead to unauthorized modification of outbound requests due to prototype pollution.
Vulnerability Detail
The vulnerability arises from the way Axios handles fetch options in its fetch adapter. Specifically, when making requests, Axios merges user-defined fetch options with inherited properties from Object.prototype. This can allow an attacker, who has previously exploited a prototype pollution vulnerability elsewhere in the application, to manipulate the headers of outgoing requests. As a result, sensitive headers can be overridden, potentially affecting authorization, cache behavior, and other critical application functionalities. The issue is specific to the fetch adapter and does not impact the Node HTTP adapter.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update Axios, consider using the Node HTTP adapter for server-side requests. Additionally, avoid passing empty fetchOptions objects in environments where prototype pollution may occur. Here is an example of a workaround:
const axios = require('axios');
Object.prototype.headers = { Authorization: 'Bearer POLLUTED' };
try {
await axios.get(url, {
adapter: 'fetch',
headers: { 'X-Good': 'yes' },
fetchOptions: {}
});
} finally {
delete Object.prototype.headers;
}
Conclusion
The Axios prototype pollution vulnerability (CVE-2026-101908) poses a significant risk to applications using the fetch adapter. By understanding the nature of this vulnerability and applying the recommended fixes or workarounds, developers can protect their applications from potential exploitation.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to manipulate the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior in applications.
If exploited, this vulnerability can allow attackers to send unauthorized headers in HTTP requests, which may compromise security features like authorization and caching.
No, this vulnerability affects Axios versions from 1.7.0 to 1.19.9. It has been fixed in version 1.20.0 and later.
You can use the Node HTTP adapter for server-side requests and avoid passing empty fetchOptions objects to mitigate the risk until you can update.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
