CVE-2026-101900

Executive Summary

CVE-2026-101900 is a prototype-pollution-assisted header injection vulnerability in the Axios HTTP client library affecting versions 1.12.0 through 1.19.x. The flaw allows a same-process attacker, combined with a prototype pollution primitive, to cause ResolveConfig to misidentify a non-FormData object as FormData-like, resulting in attacker-controlled headers being merged into fetch adapter requests. While no public exploit or nuclei template exists, the vulnerability enables header manipulation that can alter authorization, caching, metadata-service, or application-specific request behavior in affected Node.js and browser environments.

Technical Analysis

The vulnerability resides in Axios's ResolveConfig logic, which is responsible for normalizing configuration objects—including headers—before a request is dispatched through the fetch adapter. From version 1.12.0 onward, ResolveConfig began reading the inherited properties Symbol.toStringTag, append, and getHeaders when determining whether a given object should be treated as a FormData instance. This reliance on inherited property lookups (rather than own-property checks or strict instanceof validation) is the core weakness.

A separate, same-process prototype-pollution flaw is a prerequisite. If an attacker can pollute Object.prototype (or a relevant prototype chain) with properties such as Symbol.toStringTag = "FormData", an append function, and a getHeaders function, then any plain object passed into the config resolution path will appear FormData-like. Notably, the implementation explicitly blocks plain objects from being treated as FormData, but this guard can be bypassed when the object is an array or a non-plain class instance whose inherited properties satisfy the FormData heuristic.

Once the object is misclassified, ResolveConfig invokes the inherited getHeaders function. Because this function is attacker-supplied via prototype pollution, its return value is fully attacker-controlled. ResolveConfig then merges those returned headers into the outgoing fetch adapter request. This means an attacker who can influence the prototype chain within the same process can inject arbitrary headers—such as Authorization, Cache-Control, X-Forwarded-For, or cloud metadata service headers—into requests generated by the victim application.

The attack surface is therefore any application that uses Axios ≥1.12.0 and <1.20.0 and that also processes untrusted input capable of triggering prototype pollution (e.g., unsafe recursive merge, lodash.merge on attacker JSON, or query-string parsers). The browser and Node.js runtimes are both affected, though the same-process precondition makes server-side Node.js the more realistic target. CWE-74 (Injection) captures the essence: untrusted data influences the structure of a command (here, HTTP headers) that is subsequently executed by the client.

No CVSS score has been assigned by NVD at the time of writing, and no EPSS score is available from FIRST.org. The vector above is an inferred assessment based on the described mechanism and should not be treated as authoritative.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-101900; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification. The attacker identifies an application that uses a vulnerable Axios version (1.12.0–1.19.x) and exposes an input surface that reaches a prototype-pollution sink. Typical candidates include JSON APIs that perform deep merges of user-supplied objects, GraphQL resolvers, or configuration endpoints. The attacker confirms the Axios version through client fingerprinting or by observing dependency metadata if exposed.

2. Triggering the Flaw Class. The attacker first delivers a prototype-pollution payload—for example, a JSON body containing __proto__ or constructor.prototype keys—that sets inherited properties on Object.prototype: a Symbol.toStringTag value of "FormData", an append function, and a getHeaders function that returns attacker-chosen headers. This establishes the second half of the prerequisite chain.

3. Payload / Execution Method. With the prototype polluted, the attacker causes the application to pass an array or non-plain class instance into Axios's configuration resolution path (for instance, as the request body or a merged config object). Because plain objects are explicitly blocked, the attacker uses an array or class instance to slip past the guard. ResolveConfig reads the inherited Symbol.toStringTag, append, and getHeaders, classifies the object as FormData-like, invokes the inherited getHeaders, and merges its attacker-controlled return value into the fetch adapter request headers.

4. Post-Exploitation Impact. The injected headers can override Authorization to hijack authenticated sessions, manipulate Cache-Control to poison caches, inject metadata-service headers (e.g., cloud IMDS headers) to influence credential retrieval, or set application-specific headers that alter business logic. The result is request forgery, privilege escalation within the trust boundary of the victim application, or data exfiltration depending on the target's header handling.

Impact Assessment

The blast radius is limited to applications running Axios 1.12.0–1.19.x in the same process as a prototype-pollution primitive. The same-process precondition (AC:H) lowers exploitability, but once achieved, impact includes unauthorized header injection, potential authentication bypass, cache poisoning, and interaction with internal metadata services. Because Axios is ubiquitous in Node.js and browser codebases, the downstream exposure is broad even though the direct precondition is narrow. CVSS subscores: Confidentiality Low (C:L) and Integrity Low (I:L) reflect header manipulation rather than direct code execution or full data compromise; Availability is None (A:N). Business impact includes potential session hijacking, SSRF-adjacent metadata access, and trust-boundary violations in multi-tenant environments.

Detection Guidance

Sigma Rule

title: Potential Axios Prototype Pollution Header Injection (CVE-2026-101900)
id: 3f9c2a7e-1b4d-4e8a-9c1f-7a2b6d5e0f13
status: experimental
description: Detects prototype pollution attempts setting FormData-like inherited properties targeting Axios ResolveConfig
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101900
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  keywords:
    - '__proto__'
    - 'constructor.prototype'
    - 'Symbol.toStringTag'
    - 'getHeaders'
  condition: selection
level: medium

YARA Rule

rule CVE_2026_101900_Axios_ProtoPollution
{
    meta:
        description = "Detects artifacts referencing Axios FormData-like prototype pollution (CVE-2026-101900)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101900"
    strings:
        $a = "Symbol.toStringTag" ascii
        $b = "getHeaders" ascii
        $c = "__proto__" ascii
        $d = "axios" ascii nocase
    condition:
        uint32(0) == 0x464c457f or all of ($a, $b) or ($a and $c) or ($b and $c and $d)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101900 Axios Prototype Pollution Header Injection Attempt"; flow:to_server,established; content:"__proto__"; http_client_body; content:"getHeaders"; http_client_body; distance:0; classtype:attempted-admin; sid:2026101900; rev:1;)

Elastic Detection

process where event.type == "start" and process.args : ("*__proto__*", "*Symbol.toStringTag*", "*getHeaders*")

Splunk SPL Query

index=web_logs OR index=app_logs
| search ("__proto__" OR "Symbol.toStringTag" OR "getHeaders" OR "constructor.prototype")
| stats count by src_ip, uri, user_agent
| where count > 5

Wazuh OSSEC Rule

<group name="web,axio">
  <rule id="100900" level="10">
    <decoded_as>json</decoded_as>
    <match>__proto__|Symbol.toStringTag|getHeaders</match>
    <description>CVE-2026-101900: Possible Axios prototype pollution header injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 1.20.0; however, no patch sources are tracked in this dataset, so verification against the upstream repository is required.

1. Immediate Mitigations.

   • Freeze Object.prototype at application startup (Object.freeze(Object.prototype)) to block the required prototype-pollution primitive.
   • Audit all input handling for unsafe recursive merges; replace with safe-merge implementations that reject __proto__ and constructor.prototype keys.
   • Validate and whitelist outgoing headers; strip unexpected Authorization, Cache-Control, and metadata-service headers from Axios requests.

2. Patch / Upgrade Steps.

   • Upgrade Axios to 1.20.0 or later once available and verified from the official npm registry.
   • Pin dependencies and regenerate lockfiles to prevent downgrade attacks.
   • Confirm the installed version via npm ls axios and review transitive dependencies.

3. Long-Term Hardening.

   • Adopt runtime application self-protection (RASP) or WAF rules that flag prototype-pollution payloads.
   • Enforce strict schema validation on all JSON request bodies.
   • Monitor NVD and the Axios GitHub advisory database for official patch confirmation and update this assessment accordingly.

References

1. NVD — CVE-2026-101900: https://nvd.nist.gov/vuln/detail/CVE-2026-101900
2. Axios GitHub Repository (advisory/commit tracking): https://github.com/axios/axios
3. CWE-74 Injection: https://cwe.mitre.org/data/definitions/74.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. FIRST EPSS (score not yet available): https://www.first.org/epss/

No known threat actor campaigns or exploit-in-the-wild evidence is currently associated with CVE-2026-101900.