Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16827 advisory.

  - Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1     until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through     prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes,     metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter     toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value     handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a     function. Serialized field naming and data interpretation can change, maxDepth can cause request failure,     Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection     primitive. This issue is fixed in versions 0.34.0 and 1.20.0. (CVE-2026-101909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1
    until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through
    prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes,
    metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter
    toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value
    handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a
    function. Serialized field naming and data interpretation can change, maxDepth can cause request failure,
    Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection
    primitive. This issue is fixed in versions 0.34.0 and 1.20.0. (CVE-2026-101909)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1     until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through     prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes,     metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter     toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value     handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a     function. Serialized field naming and data interpretation can change, maxDepth can cause request failure,     Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection     primitive. This issue is fixed in versions 0.34.0 and 1.20.0. (CVE-2026-101909)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367998	Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.24 / 11.3.x < 11.3.11 (JSDSERVER-16827)	Nessus	Misc.	Local	high
461680	Echo: axios: security update to 0.34.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
461680	Echo: axios: security update to 0.34.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351363	Linux Distros Unpatched Vulnerability : CVE-2026-101909	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-101909

high

Tenable Plugins

high

high

high

high