{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "axios: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/axios--axios/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/axios--axios/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · fixed in Chainguard (awx 24.6.1-r66 and 48 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, azurite 3.37.0-r4, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.9-r0, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r6, gitlab-rails-ce-fips-19.1 19.1.8-r9, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r5, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 0.34.0, axios 1.20.0.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101909/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101909/",
   "title": "CVE-2026-101909 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:42:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · fixed in Chainguard (awx 24.6.1-r66 and 46 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101907/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101907/",
   "title": "CVE-2026-101907 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:36:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expression processing can block the Node.js event loop and cause denial of service. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · fixed in Chainguard (awx 24.6.1-r66 and 48 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.0 19.0.9-r2, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101906/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101906/",
   "title": "CVE-2026-101906 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:32:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · fixed in Chainguard (awx 24.6.1-r66 and 47 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101905/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101905/",
   "title": "CVE-2026-101905 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:31:00Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service. The affected identifiers are fromDataURI, DATA_URL_PATTERN, data:. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · fixed in Chainguard (awx 24.6.1-r66 and 46 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101903/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101903/",
   "title": "CVE-2026-101903 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:25:04Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · fixed in Chainguard (awx 24.6.1-r66 and 48 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.0 19.0.9-r2, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101901/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101901/",
   "title": "CVE-2026-101901 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:16:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · disclosed",
   "content_text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy. This issue is fixed in version 1.20.0.",
   "date_published": "2026-09-28T17:10:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · fixed in Chainguard (awx 24.6.1-r66 and 48 more)",
   "content_text": "Fixed versions: awx 24.6.1-r66, commercial-gitlab-rails-ee-19.1 19.1.7-r3, commercial-gitlab-rails-ee-19.2 19.2.7-r1, commercial-gitlab-rails-ee-19.3 19.3.3-r1, commercial-gitlab-rails-ee-19.4 19.4.1-r1, commercial-gitlab-rails-ee-fips-19.1 19.1.9-r0, commercial-gitlab-rails-ee-fips-19.2 19.2.7-r1, commercial-gitlab-rails-ee-fips-19.3 19.3.3-r1, commercial-gitlab-rails-ee-fips-19.4 19.4.1-r1, gitlab-rails-ce-19.0 19.0.10-r0, gitlab-rails-ce-19.1 19.1.8-r8, gitlab-rails-ce-19.2 19.2.7-r6, gitlab-rails-ce-19.3 19.3.3-r5, gitlab-rails-ce-19.4 19.4.1-r3, gitlab-rails-ce-fips-19.0 19.0.9-r2, gitlab-rails-ce-fips-19.1 19.1.8-r8, gitlab-rails-ce-fips-19.2 19.2.7-r5, gitlab-rails-ce-fips-19.3 19.3.3-r3, gitlab-rails-ce-fips-19.4 19.4.1-r5, kibana-8.19 8.19.22-r4, kibana-8.19-bitnami 8.19.22-r4, kibana-9.2 9.2.8-r25, kubeflow-centraldashboard 2.0.0-r5, lambda-nodejs22 4.0.2-r4, lambda-nodejs24 4.0.2-r4, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, langfuse-4 4.49.0-r0, langfuse-4-worker 4.49.0-r0, langfuse-fips-3 3.225.11-r2, langfuse-fips-3-worker 3.225.11-r2, langfuse-fips-4 4.49.0-r0, langfuse-fips-4-worker 4.49.0-r0, lerna 10.0.1-r8, librechat 0.8.7-r16, nextcloud-server-33 33.0.9-r1, nextcloud-server-34 34.0.4-r2, nextcloud-server-35 35.0.0-r1, opensearch-dashboards-2 2.19.6-r21, opensearch-dashboards-2-fips 2.19.6-r10, opensearch-dashboards-3 3.8.0-r8, opensearch-dashboards-3-fips 3.8.0-r5, prism 5.16.0-r13, redisinsight 3.8.0-r8, semaphore 2.19.12-r3, wazuh-dashboard 4.14.8-r3, wazuh-dashboard-fips 4.14.8-r3, wazuh-dashboard-plugins 4.14.8-r3, wazuh-dashboard-plugins-fips 4.14.8-r3.",
   "date_published": "2026-09-28T17:10:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · fixed in Debian 14 (node-axios 1.20.0-1)",
   "content_text": "Fixed versions: node-axios 1.20.0-1.",
   "date_published": "2026-09-28T17:10:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · fixed upstream (npm)",
   "content_text": "Fixed versions: axios 1.20.0.",
   "date_published": "2026-09-28T17:10:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · fixed in Red Hat hummingbird 1 (grafana12.4 0:12.4.12-0.3.hum1 and 2 more)",
   "content_text": "Fixed versions: grafana12.4 0:12.4.12-0.3.hum1, grafana13.1 0:13.1.6-0.6.hum1, grafana13.2 0:13.2.1-0.9.hum1.",
   "date_published": "2026-09-28T17:10:16Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-101898/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-101898/",
   "title": "CVE-2026-101898 · axios · fixed in Wolfi (kubeflow-centraldashboard 2.0.0-r5 and 6 more)",
   "content_text": "Fixed versions: kubeflow-centraldashboard 2.0.0-r5, langfuse-3 3.225.11-r2, langfuse-3-worker 3.225.11-r2, lerna 10.0.1-r8, nextcloud-server-33 33.0.9-r1, opensearch-dashboards-3 3.8.0-r8, prism 5.16.0-r13.",
   "date_published": "2026-09-28T17:10:16Z"
  }
 ]
}