Is CVE-2026-101900 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101900 being exploited in the wild.

How severe is CVE-2026-101900?

Medium severity, with a CVSS score of 4, published 28 September 2026.

Which products and versions are affected?

Axios 1.12.0 to 1.19.x; axios (npm) >= 1.12.0, < 1.20.0, SEMVER:introduced=1.12.0,fixed=1.20.0.

Is there a fix for CVE-2026-101900?

Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101900 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101900?

Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101900: Axios prototype pollution via inherited FormData properties

Q: Is there a fix for CVE-2026-101900?

Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101900 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101900?

Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101900 · Severity: medium · CVSS 4 · Published 2026-09-28

Axios, a widely-used HTTP client library for JavaScript, allows attackers to inject malicious request headers through a prototype-pollution weakness. When combined with a separate prototype-pollution flaw, an attacker can craft a request that appears to be FormData, causing the library to execute attacker-controlled getHeaders functions. This could lead to header manipulation, cache poisoning, credential theft, or unauthorized API calls.

Technologies: Axios, axios (npm). Vendors: Axios, npm.

Quick answers

Is CVE-2026-101900 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101900 being exploited in the wild.
How severe is CVE-2026-101900?: Medium severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?: Axios 1.12.0 to 1.19.x; axios (npm) >= 1.12.0, < 1.20.0, SEMVER:introduced=1.12.0,fixed=1.20.0.
Is there a fix for CVE-2026-101900?: Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101900 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101900?: Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

axios (npm): upgrade to 1.20.0 or later
```
npm install axios@1.20.0
```

Technical details

The vulnerability exists in the ResolveConfig function which reads inherited Symbol.toStringTag, append, and getHeaders properties when resolving FormData headers, without properly validating inherited properties. An attacker with a separate prototype-pollution capability can supply an object whose inherited getHeaders method returns arbitrary headers that are merged into fetch adapter requests. The vulnerability affects versions 1.12.0 through 1.19.x and is patched in 1.20.0.

Affected products

axios axios 1.12.0 to 1.19.x

Identifiers

CVE-2026-101900
GHSA-4hqw-qxg8-jxx2

Timeline

2026-09-28: disclosed
2026-08-12: patched: Fix merged in version 1.20.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.