CVE-2026-101900

Name of the Vulnerable Software and Affected Versions Axios versions 1.12.0 through 1.19.x

Description While resolving FormData headers, the ResolveConfig function reads inherited Symbol.toStringTag, append, and getHeaders properties. A prototype pollution flaw allows an attacker to provide an array or non-plain class instance that mimics FormData. Consequently, the inherited getHeaders() function can return attacker-controlled headers that are merged into a fetch adapter request, potentially altering authorization, cache, metadata-service, or application-specific request behavior.

Recommendations Update to version 1.20.0.