Axios CVE-2026-101900

Exploitation is NOT possible against axios alone: it requires a pre-existing, separate same-process prototype-pollution vulnerability in the host application that can plant attacker-controlled inherited properties (getHeaders, append, Symbol.toStringTag) on the prototype chain. The polluted value must be an array or a non-plain class instance that appears FormData-like - plain objects are explicitly blocked by axios. The affected code path is FormData header resolution in ResolveConfig feeding the fetch adapter, in versions 1.12.0 through 1.19.x (fixed in 1.20.0). The limiting factor is precisely this chained-flaw dependency (reflected as AT:P), which sharply narrows real-world exploitability despite the network attack vector; there is no user interaction or authentication needed once the prototype-pollution primitive is present.

This is a moderate-severity integrity flaw that is a defense-in-depth gadget, NOT a standalone remotely-exploitable bug. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N with SC:L/SI:H, 6.9) explicitly encodes AT:P (attack requirement present) and this is the decisive signal: the description states exploitation REQUIRES 'a separate same-process prototype-pollution flaw' to supply a FormData-like object whose inherited getHeaders is attacker-controlled. Without that pre-existing prototype-pollution primitive, this issue cannot be triggered - plain objects are explicitly blocked. There is no CISA KEV listing, no EPSS score provided, and no public exploit code identified at time of analysis (the fix ships hardening rather than a weaponized PoC). The impact is primarily integrity of the OUTBOUND request (SI:H - attacker can alter authorization, cache, metadata-service, or app-specific headers), with only low subsequent-system confidentiality (SC:L, e.g. cloud metadata-service header manipulation). Note the 'Information Disclosure' tag conflicts with the actual CVSS impact profile, which is integrity-dominant (VC:N/VI:N but SI:H) - verify the categorization. Despite axios's ubiquitous deployment, the chained-precondition requirement makes real-world standalone risk LOW-to-MEDIUM rather than the raw 6.9 suggesting a widely-usable network attack.

An application already suffering from a separate same-process prototype-pollution vulnerability has attacker-controlled properties injected into a prototype chain. When axios (1.12.0-1.20.0) resolves FormData headers, ResolveConfig reads the inherited getHeaders/append/Symbol.toStringTag properties, treats an attacker-supplied array or class instance as FormData-like, and merges attacker-controlled headers (e.g. a forged Authorization header or a cloud metadata-service header) into the fetch-adapter request. No public exploit code exists; exploitation is contingent on chaining a second flaw, and the CVSS AT:P attack-requirement reflects this dependency.