Skip to main content

Axios EUVDEUVD-2026-88392

| CVE-2026-101909 HIGH
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-09-28 GitHub_M GHSA-x97p-jq2g-jp4f
Node.js Code Injection Prototype Pollution Axios JavaScript npm
8.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

AC:H because exploitation depends on a separate pre-existing prototype-pollution primitive; A:H from maxDepth forcing request failure, I:L from altered field naming/data interpretation, C:N as no confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
4.8 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat
8.2 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
POC Analysis Generated
Sep 28, 2026 - 19:20 vuln.today
Patch available
Sep 28, 2026 - 19:01 EUVD
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: JavaScript added
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: npm added
Analysis Generated
Sep 28, 2026 - 18:20 vuln.today
CVE Published
Sep 28, 2026 - 17:42 cve.org
HIGH 8.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 39 npm packages depend on axios (18 direct, 21 indirect)

Ecosystem-wide dependent count for version 0.28.0.

DescriptionCVE.org

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.

Articles & Coverage 1

News 15 New Node.js Vulnerabilities - 2 Critical, 13 High Severity Sep 29, 2026

AnalysisAI

Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation is INERT on its own: it requires a pre-existing, separate prototype-pollution flaw in the same Node.js/JavaScript process to plant inherited properties (dots, indexes, metaTokens, maxDepth, visitor, or Blob) on Object.prototype BEFORE Axios serializes an object with ToFormData (i.e., the application must actually build FormData request bodies from objects). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a prototype-pollution GADGET, not a directly-triggerable flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade Axios to 0.34.0 (0.x line) or 1.20.0 (1.x line or later), per GHSA-x97p-jq2g-jp4f and the release tags v0.34.0 and v1.20.0; the underlying code changes are in PR https://github.com/axios/axios/pull/11141 (commits d19040bda7a8be2f82c3c6e1a5bc03917daee39a and d29be181f85f6fe93397a07b1f69606d9622637b), which filters shared-prototype inherited config values and excludes __proto__/constructor/prototype keys - expect the hardened merge path to convert frozen, sealed, accessor-based, or unsafe-key-bearing interceptor configs into writable filtered snapshots and to treat terminal null-prototype ancestors as fail-closed boundaries, so retest custom interceptors and adapters after upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, run a software-composition scan across all Node.js services and browser bundles to identify every instance of Axios in the affected ranges 0.28.0-0.33.x and 1.15.1-1.19.x, and simultaneously look for any other known prototype-pollution defect in the same process or dependency tree, since this issue is inert on its own and only matters when chained with such a flaw. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2021-23450 CRITICAL POC
9.8
CVE-2024-56059 CRITICAL
9.8
CVE-2021-23383 CRITICAL POC
9.8
CVE-2020-7788 CRITICAL POC
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

EUVD-2026-88392 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy