CVE-2026-101902

Executive Summary

CVE-2026-101902 is a prototype pollution read-side gadget in the Axios HTTP client affecting versions 0.27.2 through 0.33.x and 1.0.0 through 1.19.x. When an application omits an explicit HTTP method in default-instance Axios calls, the library can inherit a poisoned method value from Object.prototype, causing requests intended as safe GET operations to transmit state-changing HTTP verbs instead. This creates a privilege escalation and data integrity risk for any Node.js or browser application that combines Axios with a separate prototype pollution vulnerability elsewhere in the same process.

Technical Analysis

The vulnerability resides in Axios request dispatch logic. Axios is a promise-based HTTP client used extensively in both browser and Node.js environments. When a caller invokes axios.request({ url }) or the shorthand axios({ url }) without specifying a method property, Axios resolves the effective HTTP method by reading the method key from the merged configuration object. If Object.prototype.method has been polluted by another vulnerability in the same JavaScript process, the prototype chain lookup returns the attacker-controlled value rather than the intended default of GET.

This is explicitly a read-side gadget: Axios does not introduce the prototype pollution source. The primitive requires a separate, pre-existing prototype pollution vulnerability — for example, an unsafe deep-merge, recursive object assignment, or query-string parser in a dependency, framework, or application module. Once Object.prototype.method is set (e.g., to POST, PUT, or DELETE), every default-instance Axios request that omits an explicit method becomes a potential state-changing call. Because Object.prototype is shared across the entire JavaScript realm, a single pollution sink can silently alter the behavior of many Axios call sites across the process.

The mechanism maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, colloquially "Prototype Pollution"). The affected versions are 0.27.2 up to but not including 0.34.0 on the legacy 0.x line, and 1.0.0 up to but not including 1.20.0 on the modern line. The issue is fixed in 0.34.0 and 1.20.0.

Attack surface considerations:

• Browser context: Any page loading a vulnerable Axios version alongside a client-side prototype pollution gadget can have its outbound API calls silently rewritten.
• Node.js context: Server-side services using Axios for internal microservice calls, webhooks, or third-party API integrations are exposed if any dependency in the process contains a prototype pollution sink.
• No network-reachable Axios surface on its own: The flaw is not directly triggerable over the network against Axios itself; it is a second-stage amplification of a pollution primitive already present in the host application.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Node.js service or browser application that (a) depends on Axios in the affected range and (b) also depends on a library or endpoint containing a prototype pollution sink. Dependency manifests, public package lock files, JavaScript bundles, and HTTP responses containing Axios headers or error signatures can reveal Axios presence and version.

2. Triggering the specific flaw class. The adversary first exercises a separate prototype pollution vulnerability to set Object.prototype.method to a state-changing verb such as POST, PUT, PATCH, or DELETE. Per the description, Axios does not create this source — the pollution must come from another vulnerable component in the same process (e.g., an unsafe recursive merge on user-supplied JSON or a query-string parser).

3. Payload / execution method. After pollution, the attacker simply causes the application to make a default-instance Axios call that omits an explicit method, such as axios.request({ url }) or axios({ url }). Axios reads the inherited method value from the prototype chain and transmits the attacker-chosen verb to the intended URL instead of GET. The attacker does not need to control the URL or body — only the inherited method value — making the gadget stealthy.

4. Post-exploitation impact. A request the developer expected to be a read-only GET now performs a state-changing operation against the target endpoint. Depending on the endpoint, this can create, modify, or delete server-side resources, trigger privileged workflows, or bypass CSRF-style assumptions that treat GET as safe. Integrity and confidentiality of application data are the primary impacts; availability can be affected if destructive verbs are routed to delete endpoints.

No public exploit code, Nuclei template, or in-the-wild campaign has been observed for this CVE at the time of writing.

Impact Assessment

Axios is one of the most widely deployed HTTP client libraries in the JavaScript ecosystem, used in both browser and Node.js environments. The blast radius of this CVE is therefore determined not by direct exploitation of Axios, but by the prevalence of co-resident prototype pollution vulnerabilities in applications and their dependency chains. Any service that (a) uses an affected Axios version, (b) makes default-instance calls without an explicit method, and (c) has at least one prototype pollution sink reachable by attacker-influenced input is exposed.

Because there is no CVSS score assigned by NVD or the CNA, no official subscores are available. Conceptually, exploitation requires pre-existing conditions (a second vulnerability), which argues for high attack complexity and network attack vector while the impact is limited to integrity and confidentiality of the affected requests. The CISA KEV catalog does not list this CVE, and no EPSS score has been published by FIRST.org.

Business impact includes silent data modification, workflow tampering, and potential unauthorized state transitions in APIs that assume GET semantics. Because the manipulation is invisible in application code — the developer wrote { url }, not method: 'POST' — incident responders face a difficult forensic task distinguishing legitimate traffic from pollution-driven verb substitution.

Detection Guidance

Sigma Rule

title: Axios Prototype Pollution Method Substitution
id: 3f9a1c7e-4b2d-4e8a-9c1f-7a6d5e2b8f10
status: experimental
description: Detects default-instance Axios requests where method is inherited from polluted Object.prototype
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101902
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: nodejs
  service: application
detection:
  selection_axios:
    event.action: 'axios_request'
    url|contains: 'http'
  selection_no_method:
    method:
      - 'POST'
      - 'PUT'
      - 'DELETE'
      - 'PATCH'
    method_source: 'prototype'
  condition: selection_axios and selection_no_method
falsepositives:
  - Applications that intentionally set method via prototype patterns
level: medium
tags:
  - attack.t1190
  - cwe.1321

YARA Rule

rule CVE_2026_101902_Axios_Prototype_Pollution
{
    meta:
        description = "Detects Axios prototype pollution method-inheritance gadget"
        reference = "CVE-2026-101902"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $axios1 = "axios" ascii nocase
        $proto1 = "__proto__" ascii
        $proto2 = "Object.prototype" ascii
        $method = "method" ascii
        $req1 = "axios.request" ascii
        $ver1 = "0.27.2" ascii
        $ver2 = "0.34.0" ascii
        $ver3 = "1.20.0" ascii
    condition:
        ($axios1 and $proto1 and $method) or
        ($axios1 and $req1 and ($ver1 or $ver2 or $ver3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101902 Axios Prototype Pollution Method Substitution Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/api/"; http_uri; content:"axios"; http_header; nocase; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-101902; sid:2026101902; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name == "node" and process.args : "*axios*"]
  [network where network.protocol == "http" and http.request.method in ("POST","PUT","DELETE","PATCH") and process.name == "node"]

Splunk SPL Query

index=app_logs sourcetype=nodejs_axios
| search method IN ("POST","PUT","DELETE","PATCH") AND method_inherited=true
| stats count values(url) as urls dc(url) as unique_urls by host, process
| where count > 5
| table host process count unique_urls urls

Wazuh OSSEC Rule

<group name="axios,cve-2026-101902,">
  <rule id="101902" level="10">
    <decoded_as>json</decoded_as>
    <field name="library">axios</field>
    <field name="method_inherited">true</field>
    <description>CVE-2026-101902: Axios request used prototype-inherited method value</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>prototype_pollution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Despite the NVD description stating the issue is fixed in 0.34.0 and 1.20.0, no patch evidence has been confirmed by tracked sources; treat remediation as pending verification.

1. Immediate mitigations

   • Explicitly set the method property on every Axios call rather than relying on the default. Replace axios.request({ url }) and axios({ url }) with explicit method: 'GET' declarations.
   • Use Object.create(null) or a null-prototype configuration object where code paths merge user-supplied data, eliminating the prototype chain lookup.
   • Freeze Object.prototype or use Object.freeze(Object.prototype) in early boot paths where feasible.
   • Add runtime guards that reject non-GET verbs on endpoints expected to be read-only.

2. Patch/upgrade steps

   • Upgrade Axios to 0.34.0 or 1.20.0 as stated in the NVD description, then independently verify the fix in your deployment.
   • Audit and remediate the upstream prototype pollution source — upgrading Axios alone does not remove the sink that sets Object.prototype.method.
   • Rebuild lockfiles and container images to ensure the patched Axios version is what actually ships.

3. Long-term hardening

   • Adopt a dependency policy that treats prototype pollution sinks as critical, with automated SCA scanning for CWE-1321.
   • Integrate ESLint rules or static analysis that flag default-instance Axios calls lacking an explicit method.
   • For high-assurance services, migrate to a hardened HTTP client or wrap Axios in a thin adapter that always pins the method.
   • Monitor CISA KEV and vendor advisories for updated patch confirmation for CVE-2026-101902.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101902
• Axios project: https://github.com/axios/axios
• CWE-1321: https://cwe.mitre.org/data/definitions/1321.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-101902.