# CVE-2026-101902: Axios prototype pollution read-side gadget in request dispatch

Source: https://junglewise.ai/threats/cve-2026-101902-axios-is-a-promise-based-http-client-for-the-browser-and-node-js  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101902 · Severity: medium · CVSS 4 · Published 2026-09-28

Axios, a widely-used HTTP client library for JavaScript applications, contains a vulnerability where requests can be manipulated if Object.prototype is polluted by another vulnerability in the same process. An attacker exploiting this alongside a prototype pollution flaw could cause applications to send unintended HTTP methods (like POST instead of GET) when making requests, potentially modifying data or bypassing security checks.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios), [axios (npm)](https://junglewise.ai/threats/technologies/npm-axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-101902 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101902 being exploited in the wild.

**How severe is CVE-2026-101902?** Medium severity, with a CVSS score of 4, published 28 September 2026.

**Which products and versions are affected?** Axios 0.27.2 to 0.33.0 and 1.0.0 to 1.19.x; axios (npm) SEMVER:introduced=0.27.2,fixed=0.34.0.

**Is there a fix for CVE-2026-101902?** Yes. axios (npm): upgrade to 0.34.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101902 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101902?** Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- axios (npm): upgrade to 0.34.0 or later

  ```sh
  npm install axios@0.34.0
  ```


## Technical details

The vulnerability is a read-side gadget in Axios's request dispatch that inherits the HTTP method from Object.prototype when an explicit method is not provided. If Object.prototype.method is polluted by an unrelated vulnerability in the same process, calls like axios.request({ url }) or axios({ url }) will use the polluted method instead of defaulting to GET. This requires a separate prototype pollution source; Axios itself does not create the pollution but acts as a gadget chain.

## Affected products

- axios axios 0.27.2 to 0.33.0 and 1.0.0 to 1.19.x

## Identifiers

- CVE-2026-101902
- GHSA-9fr6-4gfg-395g

## Timeline

- 2026-09-28: disclosed
- 2026-08-12: patched: Fixed in versions 0.34.0 and 1.20.0

## References

- [https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a](https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a)
- [https://github.com/axios/axios/pull/11141](https://github.com/axios/axios/pull/11141)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)