Riskcovery

CVE-2026-101902

Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

State
Published
Severity
6.9 Medium
Published
Sep 28, 2026
Updated
Sep 28, 2026
Reserved
Sep 28, 2026

Read the record on cve.org

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:NGitHub_M

Weaknesses

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected Products

ProductVersions
axiosaxios
  • >= 1.0.0, < 1.20.0Affected
  • >= 0.27.2, < 0.34.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.