{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101908", "tracking": { "current_release_date": "2026-10-04T00:44:35.332751Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101908", "initial_release_date": "2026-09-28T18:28:41.943572Z", "revision_history": [ { "date": "2026-09-28T18:28:41.943572Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-09-28T18:28:52.060577Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T18:38:26.845909Z", "number": "3", "summary": "CVSS created.| CWES created (1).| Unknown change.| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-09-28T18:38:35.227466Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-29T06:12:22.684349Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (38).| References created (6).| CWES updated (1)." }, { "date": "2026-09-29T12:29:32.240988Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (5).| Product Identifiers created (1).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:29:38.026002Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:53:03.224280Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-09-29T12:53:21.586544Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:12:56.577359Z", "number": "10", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T16:13:03.052139Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-09-30T15:40:03.428258Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-09-30T15:40:12.554589Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-09-30T23:34:54.881379Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-10-04T00:44:29.955251Z", "number": "15", "summary": "Products connected (1).| Products removed (1)." }, { "date": "2026-10-04T00:44:30.790896Z", "number": "16", "summary": "NCSC Score updated." } ], "status": "interim", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=1.7.0|<1.20.0", "product": { "name": "vers:unknown/>=1.7.0|<1.20.0", "product_id": "CSAFPID-9482856" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.0", "product": { "name": "vers:unknown/v1.10.0", "product_id": "CSAFPID-3721220" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.0", "product": { "name": "vers:unknown/v1.11.0", "product_id": "CSAFPID-3721221" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.0", "product": { "name": "vers:unknown/v1.12.0", "product_id": "CSAFPID-5588483" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.1", "product": { "name": "vers:unknown/v1.12.1", "product_id": "CSAFPID-5588484" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.2", "product": { "name": "vers:unknown/v1.12.2", "product_id": "CSAFPID-5588485" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.0", "product": { "name": "vers:unknown/v1.13.0", "product_id": "CSAFPID-5588486" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.1", "product": { "name": "vers:unknown/v1.13.1", "product_id": "CSAFPID-5588487" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.2", "product": { "name": "vers:unknown/v1.13.2", "product_id": "CSAFPID-5588488" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.3", "product": { "name": "vers:unknown/v1.13.3", "product_id": "CSAFPID-5588489" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.4", "product": { "name": "vers:unknown/v1.13.4", "product_id": "CSAFPID-5588490" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.5", "product": { "name": "vers:unknown/v1.13.5", "product_id": "CSAFPID-8580145" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.6", "product": { "name": "vers:unknown/v1.13.6", "product_id": "CSAFPID-8580144" } }, { "category": "product_version_range", "name": "vers:unknown/v1.14.0", "product": { "name": "vers:unknown/v1.14.0", "product_id": "CSAFPID-8580143" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.0", "product": { "name": "vers:unknown/v1.15.0", "product_id": "CSAFPID-8580142" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.1", "product": { "name": "vers:unknown/v1.15.1", "product_id": "CSAFPID-8580141" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.2", "product": { "name": "vers:unknown/v1.15.2", "product_id": "CSAFPID-8583063" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.0", "product": { "name": "vers:unknown/v1.16.0", "product_id": "CSAFPID-8925641" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.1", "product": { "name": "vers:unknown/v1.16.1", "product_id": "CSAFPID-8925639" } }, { "category": "product_version_range", "name": "vers:unknown/v1.17.0", "product": { "name": "vers:unknown/v1.17.0", "product_id": "CSAFPID-8925638" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.0", "product": { "name": "vers:unknown/v1.18.0", "product_id": "CSAFPID-9484963" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.1", "product": { "name": "vers:unknown/v1.18.1", "product_id": "CSAFPID-9484962" } }, { "category": "product_version_range", "name": "vers:unknown/v1.19.0", "product": { "name": "vers:unknown/v1.19.0", "product_id": "CSAFPID-9484961" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0", "product": { "name": "vers:unknown/v1.7.0", "product_id": "CSAFPID-3636412" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.1", "product": { "name": "vers:unknown/v1.7.1", "product_id": "CSAFPID-3636416" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.2", "product": { "name": "vers:unknown/v1.7.2", "product_id": "CSAFPID-3636417" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.3", "product": { "name": "vers:unknown/v1.7.3", "product_id": "CSAFPID-3636418" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.4", "product": { "name": "vers:unknown/v1.7.4", "product_id": "CSAFPID-3658070" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.5", "product": { "name": "vers:unknown/v1.7.5", "product_id": "CSAFPID-3658071" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.6", "product": { "name": "vers:unknown/v1.7.6", "product_id": "CSAFPID-3658072" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.7", "product": { "name": "vers:unknown/v1.7.7", "product_id": "CSAFPID-3658073" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.8", "product": { "name": "vers:unknown/v1.7.8", "product_id": "CSAFPID-3721222" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.9", "product": { "name": "vers:unknown/v1.7.9", "product_id": "CSAFPID-3721223" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.0", "product": { "name": "vers:unknown/v1.8.0", "product_id": "CSAFPID-3721224" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.1", "product": { "name": "vers:unknown/v1.8.1", "product_id": "CSAFPID-3721225" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.2", "product": { "name": "vers:unknown/v1.8.2", "product_id": "CSAFPID-3721226" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.3", "product": { "name": "vers:unknown/v1.8.3", "product_id": "CSAFPID-3721227" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.4", "product": { "name": "vers:unknown/v1.8.4", "product_id": "CSAFPID-3721228" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.0", "product": { "name": "vers:unknown/v1.9.0", "product_id": "CSAFPID-3721229" } } ], "category": "product_name", "name": "Axios" } ], "category": "vendor", "name": "Axios" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8476867" } } ], "category": "product_name", "name": "jaeger" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-1409455" } } ], "category": "product_name", "name": "node-axios" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101908", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')" }, "notes": [ { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101908" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101908" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101908.json?alt=media" }, { "category": "description", "text": "A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability (where shared JavaScript object properties are modified) within the application, the fetch adapter can inherit those manipulated headers into outbound network calls. This allows an attacker to alter outgoing requests, potentially bypassing authorization controls, corrupting cache behavior, or accessing restricted internal services.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101908" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101908" }, { "category": "description", "text": "## Summary\n\nAxios fetch adapter requests can be altered by inherited properties on `fetchOptions`. The adapter resolves method, headers, body, signal, and credentials into `resolvedOptions`, creates a `Request`, and then calls `fetch(request, fetchOptions)` instead of `fetch(request, resolvedOptions)`. In runtimes such as Node's undici-backed fetch, inherited `fetchOptions.headers` can override the headers already placed on the `Request`.\n\nAxios does not create the prototype pollution source. This is a read-side gadget that becomes exploitable after same-process prototype pollution.\n\n## Impact\n\nAn attacker with a prior prototype-pollution primitive can cause affected fetch-adapter requests to send attacker-controlled headers and drop caller-specified headers. This can affect authorization, cache behavior, metadata-service interactions, or application-specific header-based controls.\n\nThe issue is specific to fetch-adapter behavior and does not affect Node HTTP adapter requests.\n\n## Affected Functionality\n\nAffected:\n\n- `adapter: 'fetch'`.\n- Runtime environments where the fetch adapter is selected.\n- Requests where `fetchOptions` is an object that does not have safe own values for sensitive fetch init fields.\n\nNot affected:\n\n- Node HTTP adapter.\n- Requests that do not use the fetch adapter.\n- Processes where `Object.prototype` is not polluted.\n\n## Technical Details\n\n`lib/adapters/fetch.js` builds:\n\n```js\nconst resolvedOptions = {\n ...fetchOptions,\n signal: composedSignal,\n method: method.toUpperCase(),\n headers: toByteStringHeaderObject(headers.normalize()),\n body: data,\n duplex: 'half',\n credentials: isCredentialsSupported ? withCredentials : undefined,\n};\n\nrequest = isRequestSupported && new Request(url, resolvedOptions);\n\nlet response = await (isRequestSupported\n ? _fetch(request, fetchOptions)\n : _fetch(url, resolvedOptions));\n```\n\nThe fallback path without `Request` uses `resolvedOptions`, but the `Request` path passes the original `fetchOptions` as the second argument to `fetch()`. That second argument can contain inherited properties from `Object.prototype`.\n\nLocal verification on axios `1.18.1` set `Object.prototype.headers = { Authorization: 'Bearer POLLUTED' }` and called the fetch adapter with `headers: { 'X-Good': 'yes' }, fetchOptions: {}`. The loopback server received `Authorization: Bearer POLLUTED` and did not receive `X-Good`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.headers = { Authorization: 'Bearer POLLUTED' };\ntry {\n await axios.get(url, {\n adapter: 'fetch',\n headers: { 'X-Good': 'yes' },\n fetchOptions: {}\n });\n} finally {\n delete Object.prototype.headers;\n}\n```\n\nExpected safe behavior is that the sanitized axios headers remain in force. Current behavior can use the inherited fetch init headers instead.\n\n## Workarounds\n\nUse the Node HTTP adapter for security-sensitive server-side requests until fixed. If the fetch adapter must be used, avoid passing empty `fetchOptions` objects in processes where prototype pollution is possible, and set explicit safe own values for fetch init fields.\n\n
\n

Original report

\n \nHello, I’m not completely sure if this is something you’d consider a security issue, since it depends on prototype pollution happening somewhere else first, but I wanted to report it just in case.\n\nI was testing the fetch adapter with polluted prototype values and found that `Object.prototype.headers` can change the request axios sends.\n\nThe issue seems to be in `lib/adapters/fetch.js`. Axios creates a `Request` with the resolved headers/method/body, but then sends it with `fetch(request, fetchOptions)`. With undici, if `fetchOptions` doesn’t have its own headers, an inherited `Object.prototype.headers` value can be used during the final fetch call.\n\nI tested it with this:\n\n```js\nimport http from 'node:http';\nimport axios from 'axios';\n\nconst server = http.createServer((req, res) => {\n res.end(JSON.stringify({\n authorization: req.headers.authorization || null,\n xGood: req.headers['x-good'] || null\n }));\n});\n\nawait new Promise(resolve => server.listen(0, '127.0.0.1', resolve));\nconst { port } = server.address();\n\nObject.prototype.headers = {\n Authorization: 'Bearer POLLUTED'\n};\n\ntry {\n const res = await axios.get(`http://127.0.0.1:${port}/`, {\n adapter: 'fetch',\n headers: { 'X-Good': 'yes' },\n fetchOptions: {}\n });\n\n console.log(res.data);\n} finally {\n delete Object.prototype.headers;\n server.close();\n}\n```\n\nThe result I get is:\n\n```json\n{\n \"authorization\": \"Bearer POLLUTED\",\n \"xGood\": null\n}\n```\n\nSo the polluted Authorization header is sent, and the normal axios header is not.\n\nChanging the fetch call to pass the already resolved options fixes it for me:\n\n```diff\n- _fetch(request, fetchOptions)\n+ _fetch(request, resolvedOptions)\n```\n\n`resolvedOptions` already includes `...fetchOptions`, so custom fetch options should still work, while headers, method, body, and signal stay as clean own values.\n
\n\n---", "title": "github - https://github.com/advisories/GHSA-vh66-26gq-q6x8" }, { "category": "other", "text": "0.00413", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.6", "title": "NCSC Score" }, { "category": "other", "text": "There is cwe data available from source Nvd, Is related to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')), There is cwe data available from source Github, The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482856", "CSAFPID-3636412", "CSAFPID-3636416", "CSAFPID-3636417", "CSAFPID-3636418", "CSAFPID-3658070", "CSAFPID-3658071", "CSAFPID-3658072", "CSAFPID-3658073", "CSAFPID-3721220", "CSAFPID-3721221", "CSAFPID-3721222", "CSAFPID-3721223", "CSAFPID-3721224", "CSAFPID-3721225", "CSAFPID-3721226", "CSAFPID-3721227", "CSAFPID-3721228", "CSAFPID-3721229", "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925641", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231" ], "known_not_affected": [ "CSAFPID-8476867", "CSAFPID-1409455" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101908" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101908" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101908" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101908.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101908" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101908" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/pull/11141" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/releases/tag/v1.20.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101908.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101908" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101908" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-vh66-26gq-q6x8" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-3636412", "CSAFPID-3636416", "CSAFPID-3636417", "CSAFPID-3636418", "CSAFPID-3658070", "CSAFPID-3658071", "CSAFPID-3658072", "CSAFPID-3658073", "CSAFPID-3721220", "CSAFPID-3721221", "CSAFPID-3721222", "CSAFPID-3721223", "CSAFPID-3721224", "CSAFPID-3721225", "CSAFPID-3721226", "CSAFPID-3721227", "CSAFPID-3721228", "CSAFPID-3721229", "CSAFPID-5588483", "CSAFPID-5588484", "CSAFPID-5588485", "CSAFPID-5588486", "CSAFPID-5588487", "CSAFPID-5588488", "CSAFPID-5588489", "CSAFPID-5588490", "CSAFPID-6014972", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8580143", "CSAFPID-8580144", "CSAFPID-8580145", "CSAFPID-8583063", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925641", "CSAFPID-9053231", "CSAFPID-9482856", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963" ] } ], "title": "CVE-2026-101908" } ] }