Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101909— Axios: Prototype Pollution Gadget in axios toFormData Options

Quick assessment

Affected
axios axios
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Axios 是一个面向浏览器和 Node.js 的基于 Promise 的 HTTP 客户端。在版本 0.28.0 至 0.34.0 以及 1.15.1 至 1.20.0 之间， 函数会处理通过原型污染（prototype pollution）传入的继承序列化选项和访客函数属性。此外，在同一进程内还存在一个原型污染漏洞，可在对象序列化之前传入继承的 、 、 、 、 或 值。 这些被继承的选项会改变 的字段命名方式和数据解析逻辑； 设置可能导致请求失败； 对象的介入会更改值处理方式；而经过污染的 函数在攻击者已具备更

CVSS 8.3 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
axios axios >= 1.15.1, < 1.20.0 affected
>= 0.28.0, < 0.34.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101909

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Axios: Prototype Pollution Gadget in axios toFormData Options
Source: CVE Program / CVE List V5
Vulnerability Description
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
axios axios >= 1.15.1, < 1.20.0 -

II. Public POCs for CVE-2026-101909

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101909

请登录查看更多情报信息。

Other References for CVE-2026-101909 (6)

Same Patch Batch · axios · 2026-09-28 · 11 CVEs total

CVE-2026-101901 8.2 HIGH Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initial
CVE-2026-101906 8.2 HIGH Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redi
CVE-2026-101903 8.2 HIGH Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
CVE-2026-101905 7.6 HIGH Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inher
CVE-2026-101898 7.0 HIGH Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
CVE-2026-101907 7.0 HIGH Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
CVE-2026-101900 6.9 MEDIUM Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
CVE-2026-101902 6.9 MEDIUM Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototyp
CVE-2026-101904 6.9 MEDIUM Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101908 6.9 MEDIUM Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

IV. Related Vulnerabilities

Same product: axios
Same vendor: axios
Same weakness: CWE-1321

V. Comments for CVE-2026-101909

No comments yet

Leave a comment