CVE-2026-101908 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-101908?
CVE-2026-101908 is a medium-severity vulnerability in axios, published on 28 Sep 2026.
Official description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.
Weakness: CWE-1321
Which versions are affected by CVE-2026-101908?
2 open source packages ship an affected version, including axios.
| Package | Affected | Fixed in |
|---|---|---|
axios npm | From 1.7.0 | 1.20.0 |
axios npm | From 1.7.0 | 1.20.0 |
How do I fix CVE-2026-101908?
Upgrade axios to 1.20.0 or later.
Is CVE-2026-101908 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-101908 exists.
Sources
Also known as CLEANSTART-2026-EI20913, CLEANSTART-2026-MZ38704, CLEANSTART-2026-VK76913, CLEANSTART-2026-ZN41930, DEBIAN-CVE-2026-101908, ECHO-3007-50ef-28a9 and 20 more.