Is CVE-2026-101908 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101908 being exploited in the wild.

How severe is CVE-2026-101908?

Medium severity, with a CVSS score of 4, published 28 September 2026.

Which products and versions are affected?

Axios 1.7.0 to 1.20.0; axios (npm) >= 1.7.0, < 1.20.0, SEMVER:introduced=1.7.0,fixed=1.20.0.

Is there a fix for CVE-2026-101908?

Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101908 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101908?

Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101908: Axios fetch adapter header injection via prototype pollution

Q: Is there a fix for CVE-2026-101908?

Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101908 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101908?

Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101908 · Severity: medium · CVSS 4 · Published 2026-09-28

Axios is an HTTP client library used in browser and Node.js applications to send and receive web requests. In versions 1.7.0 through 1.20.0, an attacker who can pollute JavaScript's global Object.prototype can inject malicious HTTP headers into requests, allowing them to bypass authorization checks, tamper with caching behavior, or access cloud metadata services. The vulnerability is fixed in version 1.20.0.

Technologies: Axios, axios (npm). Vendors: Axios, npm.

Quick answers

Is CVE-2026-101908 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101908 being exploited in the wild.
How severe is CVE-2026-101908?: Medium severity, with a CVSS score of 4, published 28 September 2026.
Which products and versions are affected?: Axios 1.7.0 to 1.20.0; axios (npm) >= 1.7.0, < 1.20.0, SEMVER:introduced=1.7.0,fixed=1.20.0.
Is there a fix for CVE-2026-101908?: Yes. axios (npm): upgrade to 1.20.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101908 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101908?: Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

axios (npm): upgrade to 1.20.0 or later
```
npm install axios@1.20.0
```

Technical details

The fetch adapter constructs a Request object with sanitized options but then passes the original fetchOptions to the fetch API as a second argument. When a separate prototype-pollution flaw populates Object.prototype.headers, the inherited fetchOptions.headers value overrides the sanitized Request headers, allowing attacker-controlled headers to bypass the library's security filtering. This requires an existing prototype-pollution vulnerability in the application or a dependency, combined with network access to trigger the request.

Affected products

Axios axios 1.7.0 to 1.20.0

Identifiers

CVE-2026-101908
GHSA-vh66-26gq-q6x8

Timeline

2026-08-12: patched: Fix merged as PR #11141
2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.