CVE-2026-101907

Executive Summary

CVE-2026-101907 is a redirect policy bypass vulnerability in Axios, a widely deployed promise-based HTTP client for browser and Node.js environments. From version 1.17.0 until 1.20.0, the fetch adapter fails to honor the maxRedirects: 0 configuration, causing the underlying fetch implementation to follow redirects even when explicitly disabled. This allows applications relying on redirect suppression for security boundaries to be redirected to internal or state-changing endpoints, potentially enabling access to internal responses or triggering unintended server-side actions.

Technical Analysis

Axios supports multiple HTTP adapters, including a fetch-based adapter introduced in recent versions. When an application issues a request with the fetch adapter and sets maxRedirects to zero, the intent is to prevent the client from following any HTTP 3xx redirect responses. The vulnerability, classified as CWE-441 (Unintended Proxy or Intermediary), arises because the fetch adapter delegates redirect handling to the underlying fetch implementation, which follows redirects by default. As a result, the redirect policy configured at the Axios layer is not enforced.

The attack surface is any application or service that uses Axios with the fetch adapter and relies on maxRedirects: 0 as a security control — for example, to prevent SSRF (Server-Side Request Forgery) style pivoting, to avoid leaking credentials to unintended hosts, or to ensure that redirect responses are inspected rather than automatically followed. An attacker who can influence the target URL (e.g., via user-supplied input, webhook configuration, or URL parameters) can cause the Axios client to follow a redirect to an internal resource. Because the redirect is followed transparently, the application may process the internal response as if it originated from the intended external endpoint, or the redirected request may reach state-changing internal endpoints that were never meant to be accessible from the original request context.

The issue is specifically tied to the fetch adapter; other Axios adapters (such as the Node.js http adapter) are not described as affected by this bypass. The fix in version 1.20.0 ensures the fetch adapter respects the maxRedirects: 0 setting and returns the redirect response unchanged instead of following it.

No public proof-of-concept, exploit code, or Nuclei template is currently available for this CVE. The technical mechanism is inferred from the NVD description; no additional code-level details (function names, internal variable names, or file paths) are provided in the source data and none are fabricated here.

Exploitation Scenarios

No public PoC is available; the attack chain described below is inferred from the vulnerability class (redirect policy bypass) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies an application that uses Axios with the fetch adapter and exposes a feature where a URL is supplied by the user (directly or indirectly). Examples include URL preview features, webhook test endpoints, or any server-side request that accepts an external URL. The attacker also needs to identify that the application intends to suppress redirects (maxRedirects: 0), which is often the case in security-sensitive contexts.

2. Triggering the flaw: The attacker supplies a URL that points to a server under their control. That server responds with an HTTP 3xx redirect (e.g., 302, 307) pointing to an internal or otherwise restricted endpoint (e.g., a cloud metadata service, an internal admin API, or a state-changing endpoint). Because the fetch adapter follows redirects despite maxRedirects: 0, the Axios client transparently requests the internal resource.

3. Payload / execution method (vulnerability-class level): The redirect itself is the payload delivery mechanism. No special encoding or injection is required beyond controlling the initial URL and the redirect target. The redirected request is made with the same Axios configuration and any associated headers or credentials that the original request would have carried, depending on how the application constructs the request. This can lead to credential leakage, access to internal responses, or invocation of state-changing internal endpoints.

4. Post-exploitation impact: Depending on the internal endpoint reached, the attacker may obtain sensitive internal data (e.g., cloud instance metadata, internal service responses) or trigger unintended state changes (e.g., modifying internal configurations, creating resources). The blast radius is bounded by the privileges and network reachability of the Axios client process. Because the bypass occurs client-side within the application, it can also be used to circumvent SSRF protections that rely on redirect suppression.

Impact Assessment

The vulnerability allows a bypass of an explicit security control (maxRedirects: 0), which can undermine SSRF defenses, cause unintended internal requests, and expose internal responses. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) reflects a network-accessible issue with high attack complexity (the attacker must control a redirecting server and the target application must use the fetch adapter with redirect suppression), no privileges or user interaction required, and scope change — meaning the vulnerable component can impact resources beyond its security scope (e.g., internal services). Confidentiality and integrity impacts are high; availability impact is none.

Affected systems include any Node.js or browser application using Axios versions 1.17.0 through 1.19.x with the fetch adapter and maxRedirects: 0. Given Axios's widespread use in APIs, serverless functions, and webhooks, the blast radius can be significant in environments where user-controlled URLs are processed and redirect suppression is a security requirement. There is no EPSS score available and the CVE is not listed in CISA KEV, indicating no known active exploitation at this time.

Detection Guidance

Sigma Rule

title: Axios Fetch Adapter Redirect Bypass Attempt
id: 3f9a2c1e-7b4d-4e8a-9c2f-1a5b6d7e8f90
status: experimental
description: Detects server-side requests that issue redirects in response to Axios fetch adapter calls, potentially exploiting CVE-2026-101907.
author: Threat Intelligence Team
date: 2026-01-15
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'GET'
    sc-status:
      - 301
      - 302
      - 303
      - 307
      - 308
    cs-uri-query|contains: 'url='
  condition: selection
falsepositives:
  - Legitimate redirects in normal application flows
level: medium
tags:
  - attack.t1190
  - cve.2026-101907

YARA Rule

rule CVE_2026_101907_Axios_Redirect_Bypass
{
    meta:
        description = "Detects Axios fetch adapter usage with maxRedirects set to zero, potentially vulnerable to CVE-2026-101907"
        author = "Threat Intelligence Team"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101907"
        severity = "high"

    strings:
        $axios = "axios" ascii nocase
        $fetch = "fetch" ascii nocase
        $maxRedirects = "maxRedirects" ascii
        $zero = "maxRedirects: 0" ascii
        $zero_alt = "maxRedirects:0" ascii

    condition:
        $axios and $fetch and ($maxRedirects and ($zero or $zero_alt))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101907 Axios Fetch Adapter Redirect Bypass Attempt"; flow:to_client; http.response_code:302; content:"Location"; http_header; classtype:attempted-recon; sid:2026101907; rev:1; metadata:created_at 2026_01_15, cve CVE-2026-101907;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ network where process.name == "node" and network.direction == "outbound" and network.protocol == "http" ]
  [ network where process.name == "node" and network.direction == "outbound" and network.protocol == "http" and network.bytes > 0 ]

Splunk SPL Query

index=web sourcetype=access_combined
| search status IN (301, 302, 303, 307, 308) AND (uri_query="*url=*" OR uri_query="*redirect=*")
| stats count by src_ip, uri, status, location
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100907" level="10">
    <if_sid>31100</if_sid>
    <id>^3(01|02|03|07|08)$</id>
    <description>CVE-2026-101907: Possible Axios fetch adapter redirect bypass - HTTP redirect response to user-supplied URL</description>
    <group>cve_2026_101907,redirect_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Upgrade Axios to version 1.20.0 or later, where the fetch adapter correctly honors maxRedirects: 0. If upgrade is not immediately possible, avoid using the fetch adapter for requests that require redirect suppression; use an alternative adapter (e.g., the Node.js http adapter) that respects the maxRedirects setting.
   • Validate and restrict user-supplied URLs to a strict allowlist of trusted external hosts. Do not rely solely on maxRedirects: 0 as an SSRF control.
   • Implement network-level egress filtering to block requests to internal metadata services, private IP ranges, and administrative endpoints from application servers.
   • Where feasible, disable automatic redirect following at the HTTP client library level in addition to Axios configuration.

2. Patch/upgrade steps:

   • Identify all applications and services using Axios versions 1.17.0 through 1.19.x with the fetch adapter.
   • Test upgrade to Axios 1.20.0 in a staging environment, verifying that redirect handling behaves as expected.
   • Deploy the upgraded version across affected services. Since no vendor patch metadata is currently tracked (patch confidence 0/4), verify the fix by confirming the Axios version and testing maxRedirects: 0 behavior directly.
   • Monitor dependency manifests (package.json, lockfiles) for transitive Axios dependencies that may also need updating.

3. Long-term hardening:

   • Adopt a defense-in-depth approach to SSRF prevention: combine URL allowlisting, DNS pinning, network segmentation, and response validation.
   • Regularly audit HTTP client configurations for security-relevant settings (redirects, proxies, timeouts, TLS verification).
   • Integrate dependency scanning and software composition analysis (SCA) into CI/CD pipelines to detect vulnerable Axios versions and other transitive dependencies.
   • Maintain an inventory of internal endpoints that should never be reachable from application-originated requests, and enforce network policies to block access.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101907
• Axios GitHub repository: https://github.com/axios/axios
• Axios releases (version 1.20.0): https://github.com/axios/axios/releases
• CWE-441: Unintended Proxy or Intermediary: https://cwe.mitre.org/data/definitions/441.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-101907. The CVE is not listed in CISA KEV, and no public PoC or exploit code is available at this time.