CVE-2026-101900
Fixed in a distro release EPSS <1%CVSS 6.9
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | awx | 24.6.1-r66 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.8-r8 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.7-r6 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.3-r5 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.1-r3 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r2 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.7-r5 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.3-r3 |
| Chainguard | gitlab-rails-ce-fips-19.4 | 19.4.1-r5 |
| Chainguard | kibana-8.19 | 8.19.22-r4 |
| Chainguard | kibana-8.19-bitnami | 8.19.22-r4 |
| Chainguard | kibana-9.2 | 9.2.8-r25 |
| Chainguard | kibana-9.3 | no fix |
| Chainguard | kubeflow-centraldashboard | 2.0.0-r5 |
| Chainguard | lambda-nodejs22 | 4.0.2-r4 |
| Chainguard | lambda-nodejs24 | 4.0.2-r4 |
| Chainguard | langfuse-3 | 3.225.11-r2 |
| Chainguard | langfuse-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-4 | 4.49.0-r0 |
| Chainguard | langfuse-4-worker | 4.49.0-r0 |
| Chainguard | langfuse-fips-3 | 3.225.11-r2 |
| Chainguard | langfuse-fips-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-fips-4 | 4.49.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.49.0-r0 |
| Chainguard | lerna | 10.0.1-r8 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | nextcloud-server-33 | 33.0.9-r1 |
| Chainguard | nextcloud-server-34 | 34.0.4-r2 |
| Chainguard | nextcloud-server-35 | 35.0.0-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r21 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.6-r10 |
| Chainguard | opensearch-dashboards-3 | 3.8.0-r8 |
| Chainguard | opensearch-dashboards-3-fips | 3.8.0-r5 |
| Chainguard | prism | 5.16.0-r13 |
| Chainguard | redisinsight | 3.8.0-r8 |
| Chainguard | semaphore | 2.19.12-r3 |
| Chainguard | wazuh-dashboard | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.8-r3 |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.20.0-1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.3.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.6.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.9.hum1 |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | kubeflow-centraldashboard | 2.0.0-r5 |
| Wolfi | langfuse-3 | 3.225.11-r2 |
| Wolfi | langfuse-3-worker | 3.225.11-r2 |
| Wolfi | lerna | 10.0.1-r8 |
| Wolfi | nextcloud-server-33 | 33.0.9-r1 |
| Wolfi | opensearch-dashboards-3 | 3.8.0-r8 |
| Wolfi | prism | 5.16.0-r13 |