CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Attackers can hijack HTTP requests and intercept credentials by exploiting prototype pollution to override the Node.js socket factory in Axios.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101905?
CVE-2026-101905 is a high-severity code injection vulnerability in axios, published on 28 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.
Which versions are affected by CVE-2026-101905?
2 open source packages ship an affected version, including axios.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | From 1.15.2 | 1.20.0 |
axios npm | From 1.15.2 | 1.20.0 |
How do I fix CVE-2026-101905?
Upgrade axios to 1.20.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-101905 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-101905 exists.
Sources
Also known as CLEANSTART-2026-DD48515, CLEANSTART-2026-LR06442, CLEANSTART-2026-VO63883, DEBIAN-CVE-2026-101905, ECHO-0d82-492b-70cb, GHSA-m8m8-qj5v-23w3 and 12 more.