CVE-2026-101902
Fixed in a distro release EPSS <1%CVSS 6.9
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 0.34.0 |
| npm | axios | 1.20.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | awx | 24.6.1-r66 |
| Chainguard | azurite | 3.37.0-r4 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.9-r0 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.7-r6 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.3-r5 |
| Chainguard | gitlab-rails-ce-19.4 | 19.4.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r2 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.8-r9 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.7-r5 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.3-r5 |
| Chainguard | gitlab-rails-ce-fips-19.4 | 19.4.1-r5 |
| Chainguard | kibana-8.19 | 8.19.22-r4 |
| Chainguard | kibana-8.19-bitnami | 8.19.22-r4 |
| Chainguard | kibana-9.2 | 9.2.8-r25 |
| Chainguard | kibana-9.3 | no fix |
| Chainguard | kubeflow-centraldashboard | 2.0.0-r5 |
| Chainguard | lambda-nodejs22 | 4.0.2-r4 |
| Chainguard | lambda-nodejs24 | 4.0.2-r4 |
| Chainguard | langfuse-3 | 3.225.11-r2 |
| Chainguard | langfuse-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-4 | 4.49.0-r0 |
| Chainguard | langfuse-4-worker | 4.49.0-r0 |
| Chainguard | langfuse-fips-3 | 3.225.11-r2 |
| Chainguard | langfuse-fips-3-worker | 3.225.11-r2 |
| Chainguard | langfuse-fips-4 | 4.49.0-r0 |
| Chainguard | langfuse-fips-4-worker | 4.49.0-r0 |
| Chainguard | lerna | 10.0.1-r8 |
| Chainguard | librechat | 0.8.7-r16 |
| Chainguard | nextcloud-server-33 | 33.0.9-r1 |
| Chainguard | nextcloud-server-34 | 34.0.4-r2 |
| Chainguard | nextcloud-server-35 | 35.0.0-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r21 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.6-r10 |
| Chainguard | opensearch-dashboards-3 | 3.8.0-r8 |
| Chainguard | opensearch-dashboards-3-fips | 3.8.0-r5 |
| Chainguard | prism | 5.16.0-r13 |
| Chainguard | redisinsight | 3.8.0-r8 |
| Chainguard | semaphore | 2.19.12-r3 |
| Chainguard | wazuh-dashboard | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-fips | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins | 4.14.8-r3 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.8-r3 |
| Debian 12 | node-axios | no fix |
| Debian 13 | node-axios | no fix |
| Debian 14 | node-axios | 1.20.0-1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.3.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.6-0.6.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.1-0.9.hum1 |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | kubeflow-centraldashboard | 2.0.0-r5 |
| Wolfi | langfuse-3 | 3.225.11-r2 |
| Wolfi | langfuse-3-worker | 3.225.11-r2 |
| Wolfi | lerna | 10.0.1-r8 |
| Wolfi | nextcloud-server-33 | 33.0.9-r1 |
| Wolfi | opensearch-dashboards-3 | 3.8.0-r8 |
| Wolfi | prism | 5.16.0-r13 |