CVE-2026-101904

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.19.x

Description The dispatchRequest() function normalizes inherited Object.prototype.headers from a replacement request configuration. When a same-process prototype pollution flaw sets Object.prototype.headers and trusted request interceptors return a new configuration lacking its own headers property, dispatchRequest() resolves the inherited headers during normalization. This allows downstream request processing to observe attacker-controlled headers, including authorization-related values. Prototype pollution is a vulnerability where an attacker can manipulate the prototype of a base object, causing all objects inheriting from that prototype to have the injected properties.

Recommendations Update to version 1.20.0.