CVE-2026-101905: Axios HTTP adapter prototype pollution leading to man-in-the-middle

CVE-2026-101905 · Severity: high · CVSS 4 · Published 2026-09-28

Axios is a popular HTTP client library for Node.js and browsers that applications use to make web requests. Versions 1.15.2 through 1.19.x are vulnerable to a prototype pollution attack that, combined with a separate pollution flaw, allows an attacker to intercept HTTP requests and steal sensitive data like authentication credentials or inject malicious responses while the application believes it is communicating with a legitimate server.

Technologies: Axios, axios (npm). Vendors: Axios, npm.

Quick answers

Is CVE-2026-101905 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101905 being exploited in the wild.
How severe is CVE-2026-101905?
High severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?
Axios 1.15.2 to 1.19.x; axios (npm) >= 1.15.2, < 1.20.0, SEMVER:introduced=1.15.2,fixed=1.20.0.
Is there a fix for CVE-2026-101905?
Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101905 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-101905?
Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • axios (npm): upgrade to 1.20.0 or later
    npm install axios@1.20.0

Technical details

The Node HTTP adapter in lib/adapters/http.js fails to provide its own createConnection value, allowing a same-process prototype pollution attack to inject a function onto Object.prototype.createConnection. Node then inherits and invokes this attacker-controlled socket factory, redirecting requests to an attacker-controlled endpoint that receives request headers, bodies, and credentials while returning spoofed responses. The vulnerability requires a separate prototype pollution gadget in the application but results in complete request interception and response manipulation. Fixed in version 1.20.0.

Affected products

  • Axios Axios 1.15.2 to 1.19.x

Identifiers

  • CVE-2026-101905
  • GHSA-m8m8-qj5v-23w3

Timeline

  • 2026-08-12: patched: Fixed in version 1.20.0
  • 2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.