SB20260917241 - Multiple vulnerabilities in axios

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917241

SB20260917241 - Multiple vulnerabilities in axios

Published: September 17, 2026 Updated: October 16, 2026

Security Bulletin ID SB20260917241
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Uncaught Exception (CVE-ID: CVE-2026-101901)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper exception handling in Http2Sessions.getSession() when a ClientHttp2Session emits an error during HTTP/2 session initialization. A remote attacker can influence a request destination or operate a destination server to cause a denial of service.

Only applications using the Node.js HTTP adapter with httpVersion: 2 are affected.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-101898)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose internal service responses and modify internal systems.

The vulnerability exists due to improper enforcement of DNS lookup and proxy controls in the Node.js HTTP/2 adapter when handling requests with httpVersion: 2. A remote attacker can supply a request destination that causes a direct connection to a destination blocked by configured DNS lookup or proxy controls to disclose internal service responses and modify internal systems.

Exploitation requires an application-level trust boundary in which user-influenced URLs are constrained by axios lookup or proxy policy.


3) Prototype pollution (CVE-ID: CVE-2026-101909)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to alter serialized request data or cause a denial of service.

The vulnerability exists due to improper control of object prototype attributes in axios toFormData option handling when serializing multipart or URL-encoded form data. A remote attacker can trigger form-data serialization to alter serialized request data or cause a denial of service.

Exploitation requires Object.prototype to have been polluted elsewhere in the same process.


4) Inefficient regular expression complexity (CVE-ID: CVE-2026-101906)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the shouldBypassProxy hostname normalization function when processing a crafted hostname in an untrusted redirect Location. A remote attacker can send a redirect response with a crafted Location header to cause a denial of service.

Exploitation requires the Node.js HTTP adapter to use environment proxy handling with a non-empty NO_PROXY or no_proxy value while redirects are followed.


5) Inefficient regular expression complexity (CVE-ID: CVE-2026-101903)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the fromDataURI data URL parser of the Node.js HTTP adapter when parsing a malformed data URL containing many slashes and no comma. A remote attacker can send a specially crafted data URL to cause a denial of service.

Exploitation requires an application to pass an untrusted URL string to axios for processing.


6) Prototype pollution (CVE-ID: CVE-2026-101902)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform unintended state-changing HTTP requests.

The vulnerability exists due to improper handling of inherited object prototype properties in Axios default-instance request dispatch when processing requests that omit an explicit method. A remote attacker can exploit a separate prototype-pollution vulnerability to set Object.prototype.method and alter the HTTP method used for the request.

Only default-instance axios.request({ url }) and axios({ url }) calls without an own method are affected by the confirmed method path.


7) Prototype pollution (CVE-ID: CVE-2026-101908)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to alter outbound requests.

The vulnerability exists due to improper handling of inherited properties in the Axios fetch adapter when invoking fetch with the original fetchOptions after creating a Request. A remote attacker can cause inherited fetchOptions values to override request options to alter outbound requests.

Exploitation requires a prior same-process prototype-pollution primitive.


8) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-101907)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access internal responses or trigger state-changing internal endpoints.

The vulnerability exists due to improper redirect handling in the fetch adapter when handling requests configured with maxRedirects: 0. A remote attacker can supply an initial URL or control a redirecting server to access internal responses or trigger state-changing internal endpoints.

Exploitation requires the fetch adapter to be selected and the redirect target to be reachable from the application environment.


9) Protection mechanism failure (CVE-ID: CVE-2026-101899)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a protection mechanism failure in the Node.js adapter's shouldBypassProxy helper when processing requests with CIDR-form NO_PROXY entries. A remote attacker can cause requests intended to bypass a configured proxy to be routed through it to disclose sensitive information.

Exploitation depends on the configured proxy being outside the intended trust boundary.


10) Unintended Proxy or Intermediary (CVE-ID: CVE-2026-101905)

CWE-ID: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and manipulate application responses.

The vulnerability exists due to improper handling of inherited request options in the Node HTTP adapter when processing Node HTTP requests after Object.prototype.createConnection has been polluted. A remote user can cause a polluted createConnection function to redirect a request socket to an attacker-controlled endpoint to disclose sensitive information and manipulate application responses.

Exploitation requires a separate prototype-pollution primitive in the same process.


Remediation

Install update from vendor's website.

References