CVE-2026-101908

Name of the Vulnerable Software and Affected Versions Axios versions 1.7.0 through 1.19.x

Description The fetch adapter constructs a Request using sanitized resolvedOptions but subsequently invokes fetch using the original fetchOptions. Due to a same-process prototype pollution flaw—where Object.prototype.headers is populated—the fetchOptions.headers value is resolved through inheritance. This inherited value overrides the sanitized Request headers via the second argument passed to fetch. Consequently, an attacker can control request headers to manipulate authorization, caching, metadata-service access, or application-specific behavior.

Recommendations Update to version 1.20.0.