cyfenced.com →

[ CVE-2026-101900 · Published 28 Sep 2026 ]

Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

CVSS 6.9 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

[ Fixes ]Fixes and patches

  • axios 1.20.0Fixed version · GitHub Advisories · npm package axios: upgrade to 1.20.0 or later (affected >= 1.12.0, < 1.20.0)

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1336

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs

[ Packages ]Affected open-source packages

[ References ]References