CVE-2026-101902

medium

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.

References

https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g

https://github.com/axios/axios/releases/tag/v1.20.0

https://github.com/axios/axios/releases/tag/v0.34.0

https://github.com/axios/axios/pull/11141

https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

Details

Source: Mitre, NVD

Published: 2026-09-28

Updated: 2026-09-28

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Severity: Medium

EPSS

EPSS: 0.00413