Unintended Proxy or Intermediary in axios - CVE-2026-101905
Published: September 17, 2026 / Updated: September 29, 2026
Vulnerability identifier: #VU150722
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-101905
CWE-ID: CWE-441
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and manipulate application responses.
The vulnerability exists due to improper handling of inherited request options in the Node HTTP adapter when processing Node HTTP requests after Object.prototype.createConnection has been polluted. A remote user can cause a polluted createConnection function to redirect a request socket to an attacker-controlled endpoint to disclose sensitive information and manipulate application responses.
Exploitation requires a separate prototype-pollution primitive in the same process.
Affected software
axios
How to mitigate CVE-2026-101905
Install security update from vendor's website.
axios - update to 1.20.0