CVE-2026-101902: Axios Prototype Pollution Vulnerability Allows HTTP Method Override
Summary
CVE-2026-101902: Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. Affects axios across 2 version ranges.
>= 0.27.2, < 0.34.0
>= 1.0.0, < 1.20.0
Fixed in 0.34.0 or 1.20.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. The library is widely adopted due to its ease of use, promise-based architecture, and ability to handle requests and responses seamlessly. However, it is susceptible to a prototype pollution vulnerability that can lead to unintended HTTP method changes, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from the default instance of Axios, which can read inherited properties from Object.prototype when an explicit HTTP method is not provided. If an attacker manages to pollute Object.prototype.method, they can manipulate Axios requests to use an unexpected HTTP method (e.g., DELETE, POST) instead of the default GET. This can lead to unauthorized state changes, data corruption, or even denial of service, depending on the target endpoint's handling of HTTP methods. The issue is not caused by Axios itself but rather by its reliance on inherited properties without proper safeguards.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.27.2, < 0.34.00.34.0npm install axios@0.34.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can avoid using the default instance of Axios for requests. Instead, use explicit method aliases such as axios.get(url) or provide an explicit method in your request configuration. For example:
axios.request({ url: 'http://example.com/resource', method: 'GET' });
This ensures that the request uses the intended HTTP method and is not influenced by any prototype pollution.
Conclusion
The Axios prototype pollution vulnerability (CVE-2026-101902) poses a significant risk by allowing attackers to manipulate HTTP methods in requests. It is crucial for developers to update to the latest versions of Axios to mitigate this risk and to implement workarounds if immediate updates cannot be performed. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for axios →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to unintended behavior in applications that rely on object properties.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The vulnerability can lead to unauthorized HTTP requests, data corruption, unintended writes, and denial of service, depending on how the target endpoint processes HTTP methods.
Yes, the vulnerability affects Axios versions prior to 0.34.0 and 1.20.0. Updating to the latest version will mitigate the risk.
If immediate updates are not possible, implement workarounds by using explicit method aliases or providing an explicit method in your request configurations to avoid relying on the default instance.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
