CVE-2026-101904: Axios prototype pollution in request header handling

CVE-2026-101904 · Severity: medium · CVSS 4 · Published 2026-09-28

Axios, a widely-used HTTP client library for JavaScript, contains a prototype pollution vulnerability in versions 1.0.0 through 1.19.x that allows attackers to inject malicious headers into requests. When combined with another prototype pollution flaw, an attacker can corrupt shared object prototypes to inject authorization headers and other sensitive values that downstream request processing will observe, potentially leading to unauthorized API calls or credential theft. This is fixed in version 1.20.0.

Technologies: Axios, axios (npm). Vendors: Axios, npm.

Quick answers

Is CVE-2026-101904 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101904 being exploited in the wild.
How severe is CVE-2026-101904?
Medium severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?
Axios 1.0.0 through 1.19.x; axios (npm) >= 1.0.0, < 1.20.0, SEMVER:introduced=1.0.0,fixed=1.20.0.
Is there a fix for CVE-2026-101904?
Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101904 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-101904?
Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • axios (npm): upgrade to 1.20.0 or later
    npm install axios@1.20.0

Technical details

The dispatchRequest function normalizes inherited Object.prototype.headers from request configurations, and in the presence of a separate prototype pollution vulnerability that sets Object.prototype.headers, trusted request interceptors can return a new configuration without an own headers property. After the interceptor chain executes, dispatchRequest resolves the inherited headers during normalization, allowing attacker-controlled headers to reach downstream request processing. The attack requires same-process prototype pollution to set Object.prototype.headers in the first place, making this a chained vulnerability.

Affected products

  • Axios Axios 1.0.0 through 1.19.x

Identifiers

  • CVE-2026-101904
  • GHSA-j8rh-479h-cp32

Timeline

  • 2026-08-12: patched: Fix merged in commit d19040bda7a8be2f82c3c6e1a5bc03917daee39a
  • 2026-09-28: disclosed: CVE-2026-101904 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.