CVE-2026-101909

Executive Summary

CVE-2026-101909 is a prototype pollution vulnerability (CWE-1321) in Axios, a widely deployed promise-based HTTP client for browsers and Node.js. From versions 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, the toFormData serialization logic processes inherited serialization options and visitor properties supplied through prototype pollution. In environments where a separate same-process prototype-pollution flaw already exists, an attacker can influence field naming, data interpretation, maxDepth limits, Blob value handling, and potentially trigger execution of a polluted visitor. The issue is fixed in versions 0.34.0 and 1.20.0; deployments running the affected ranges remain at risk.

Technical Analysis

The vulnerability resides in Axios's toFormData utility, which converts JavaScript objects into FormData instances for multipart or URL-encoded request bodies. Prior to the fixed releases, toFormData reads serialization configuration directly from an options object, including properties named dots, indexes, metaTokens, maxDepth, visitor, and Blob (referencing Blob here denotes the Blob-related value-handling option described in the advisory). Because the function does not distinguish between own properties and inherited properties, properties present on Object.prototype are honored as if they were legitimately supplied by the caller.

CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes, commonly "prototype pollution") is the root weakness class. The advisory is explicit that CVE-2026-101909 by itself is not a standalone compromise primitive: it is a second-stage consumer of a prototype-pollution condition that originates from a separate same-process flaw. In other words, an attacker must first succeed in polluting Object.prototype through another vulnerability or through untrusted input that reaches an unsafe merge/recursive-assignment sink within the same Node.js process (or browser context). Once that precondition is met, the inherited options are silently absorbed by toFormData before any object serialization takes place.

The observable effects, as enumerated in the NVD description, are concrete and bounded:

1. Field naming alteration — inherited dots and indexes change how nested keys are flattened into FormData field names (dot notation versus bracket/index notation).
2. Data interpretation alteration — inherited metaTokens changes how JSON-encoded values are labeled and interpreted during serialization.
3. Request failure — an inherited maxDepth can force request failure (e.g., by capping recursion depth so that legitimate nested payloads are truncated or rejected).
4. Value-handling alteration — an inherited Blob option changes how values are converted/handled during serialization.
5. Visitor execution — a polluted visitor is invoked during serialization. However, the advisory explicitly qualifies this: the visitor execution only occurs "when an attacker already has the stronger ability to inject a function." Injecting a function into the prototype is a strictly stronger primitive than injecting a value, so the visitor path does not broaden the attacker's capability beyond what the originating pollution flaw already grants.

The attack surface is therefore any application that (a) runs Axios in one of the affected version ranges, and (b) shares a process/global scope with a code path that permits prototype pollution from attacker-influenced input. This is common in Node.js backend services that parse user-supplied JSON/YAML/query strings and perform recursive merges without prototype-safe handling.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the mechanics stated in the advisory. An attack against CVE-2026-101909 requires a two-stage chain and is not exploitable in isolation.

1. Reconnaissance / target identification. The attacker identifies a target application that uses Axios within an affected range. Because the version cannot be reliably fingerprinted from network traffic alone, reconnaissance typically focuses on the application's technology stack (Node.js services, server-side request handling that generates FormData payloads) and on whether the application accepts structured, nested input (JSON bodies, query parameter parsing, configuration merges) that could reach an unsafe merge sink.

2. Triggering the prerequisite prototype pollution. The attacker first exploits a separate same-process vulnerability or unsafe input handler to set properties on Object.prototype — specifically dots, indexes, metaTokens, maxDepth, visitor, or the Blob-related option. This is a precondition, not part of CVE-2026-101909 itself, but it is essential: without an inherited property on the prototype chain, toFormData behaves normally.

3. Invoking the vulnerable serialization path. Once the prototype is polluted, the attacker induces the application to call Axios with a request whose body passes through toFormData (e.g., a request using multipart or URL-encoded FormData serialization). During serialization, toFormData reads the inherited options from the prototype chain and applies them. Depending on which properties were polluted, the attacker can change field naming and value interpretation (dots, indexes, metaTokens, Blob), force request failure (maxDepth), or — only if the attacker already possesses the stronger function-injection primitive — cause the visitor callback to execute.

4. Post-exploitation impact. The practical impact is manipulation of the serialized request body (field names and value interpretation), denial of request processing (maxDepth-induced failure), or, under the stronger function-injection primitive, execution of attacker-supplied logic via the visitor callback. Because the visitor path requires function injection — a capability strictly stronger than this CVE — the incremental risk from visitor execution is limited. The realistic incremental impact of CVE-2026-101909 is therefore data-integrity and availability effects on requests serialized through toFormData, plus potential downstream application misbehavior when field naming or value interpretation is silently altered.

Impact Assessment

The CVSS score for this CVE is N/A; no official CVSS vector has been assigned by the NVD as of this report, so no subscores (AV/AC/PR/UI/S/C/I/A) can be authoritatively cited. The MITRE weakness classification is CWE-1321. The EPSS score has not been published by FIRST.org; no EPSS value should be assumed. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, and no observed exploitation in the wild is documented in the provided data.

Business impact is contingent on the presence of the prerequisite prototype-pollution flaw in the same process. Where such a flaw exists, the blast radius spans every Axios request whose body is serialized through toFormData in that process:

• Integrity: Serialized field names and value interpretation can be silently altered, which may corrupt business logic, backend parsing, or record creation that consumes the request body.
• Availability: A polluted maxDepth can force request failure, causing functional breakage or localized denial of service for affected endpoints.
• Confidentiality: Not directly implicated by the described behavior; the advisory does not claim data disclosure or exfiltration.
• Scope: The affected component is a library, so impact is realized in the consuming application rather than in Axios itself. Fan-out is large because Axios is ubiquitous across Node.js and browser applications, but each affected deployment must independently satisfy the two-stage precondition.

Systems most exposed are Node.js services that (1) use Axios in the affected ranges, (2) accept attacker-influenced structured input, and (3) perform recursive object merges without prototype-safe handling.

Detection Guidance

Detection strategy focuses on (a) locating affected Axios versions in the dependency tree and (b) detecting prototype-pollution activity in the same process, since CVE-2026-101909 is a consumer of that condition.

Sigma Rule

title: Prototype Pollution Sink Activity Preceding Axios toFormData Serialization
id: 3f9a1c72-0b4e-4d21-9c7a-1e5b2d8a6f04
status: experimental
description: Detects process/node activity potentially indicating prototype pollution primitives
  such as __proto__ or constructor.prototype being set, which are prerequisites for
  CVE-2026-101909 in Axios toFormData.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101909
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cwe.1321
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - '__proto__'
      - 'constructor.prototype'
      - 'Object.prototype'
  condition: selection_cmd
falsepositives:
  - Legitimate developer debugging or testing of prototype handling
  - Security tooling and scanners
level: medium

YARA Rule

rule CVE_2026_101909_Axios_ProtoPollution_Sink
{
    meta:
        description = "Detects references to Axios toFormData serialization options associated with CVE-2026-101909 prototype pollution"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101909"
        author = "Threat Intelligence"
        date = "2026-01-01"
        cwe = "CWE-1321"

    strings:
        $s1 = "toFormData" ascii wide
        $s2 = "metaTokens" ascii wide
        $s3 = "maxDepth" ascii wide
        $s4 = "__proto__" ascii wide
        $s5 = "constructor" ascii wide
        $s6 = "prototype" ascii wide

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or filesize > 0
        and 1 of ($s1, $s2, $s3)
        and 1 of ($s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101909 Possible Prototype Pollution Parameter in HTTP Request"; flow:to_server,established; content:"__proto__"; http_uri; nocase; sid:2026101901; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-101909, cwe CWE-1321; classtype:attempted-recon;)
alert http any any -> any any (msg:"CVE-2026-101909 Prototype Pollution via constructor.prototype in Body"; flow:to_server,established; content:"constructor"; http_client_body; nocase; content:"prototype"; http_client_body; nocase; distance:0; within:64; sid:2026101902; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-101909; classtype:attempted-recon;)

Elastic Detection

process where process.name in ("node", "node.exe") and process.command_line :
  ("*__proto__*", "*constructor.prototype*", "*Object.prototype*")

Splunk SPL Query

index=web OR index=app earliest=-24h
| eval proto_poll = if(match(_raw, "(?i)(__proto__|constructor\.prototype|Object\.prototype)"), 1, 0)
| eval axios_form = if(match(_raw, "(?i)(toFormData|multipart/form-data|application/x-www-form-urlencoded)"), 1, 0)
| where proto_poll=1 OR (proto_poll=1 AND axios_form=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by host, url, user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,prototype_pollution,">
  <rule id="101909" level="10">
    <decoded_as>web|json</decoded_as>
    <regex type="pcre2">(?i)(__proto__|constructor\.prototype|Object\.prototype)</regex>
    <description>CVE-2026-101909: Possible prototype pollution input targeting Axios toFormData serialization</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_1321,</group>
  </rule>
  <rule id="101910" level="12">
    <if_sid>101909</if_sid>
    <regex type="pcre2">(?i)(toFormData|multipart/form-data)</regex>
    <description>CVE-2026-101909: Prototype pollution correlated with Axios form serialization path</description>
    <group>cwe_1321,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the advisory states the issue is fixed in versions 0.34.0 and 1.20.0, no vendor advisory, patch reference, or source evidence is present in the tracked data; teams should independently verify the fixed releases against the upstream project before relying on them.

1. Immediate mitigations

   • Inventory every dependency tree for Axios versions in the ranges 0.28.0–0.33.x and 1.15.1–1.19.x (for example, via npm ls axios or SBOM inspection).
   • Identify and remediate any same-process prototype-pollution flaws, since CVE-2026-101909 requires that precondition. Treat prototype pollution as the primary defect and Axios's toFormData behavior as the downstream consumer.
   • Harden input handling: reject or sanitize keys matching __proto__, constructor, and prototype in all incoming JSON, query, and configuration parsing paths.
   • Freeze or null-prototype sensitive objects (Object.freeze(Object.prototype), Object.create(null)) where feasible in Node.js services to prevent inherited-property absorption.

2. Patch / upgrade steps

   • Upgrade Axios to 0.34.0 or 1.20.0, which the advisory states resolve the issue; re-verify with the upstream repository, as patch provenance in the provided data is unconfirmed.
   • Where immediate upgrade is not possible, isolate affected services and apply compensating controls (input validation, prototype hardening) until the upgrade can be performed.
   • Re-run dependency and SBOM tooling after upgrade to confirm no residual affected versions remain in transitive dependencies.

3. Long-term hardening

   • Adopt prototype-safe recursive merge/serialization utilities and enforce them in code review.
   • Add automated SCA/CI gates that fail builds on known-vulnerable Axios ranges and on prototype-pollution-prone parsing libraries.
   • Monitor for CVE-2026-101909 updates, vendor advisories, and CISA KEV changes; the CVE is not currently in KEV and has no published EPSS score or CVSS vector, so re-assessment is required as data matures.

References

• NVD — CVE-2026-101909: https://nvd.nist.gov/vuln/detail/CVE-2026-101909
• CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes: https://cwe.mitre.org/data/definitions/1321.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Axios upstream project repository and release notes (verify fixed versions 0.34.0 and 1.20.0 against the official source): https://github.com/axios/axios
• FIRST.org EPSS (score not yet published for this CVE): https://www.first.org/epss/

No threat actor campaigns, public proof-of-concept code, Nuclei templates, or exploit-in-the-wild evidence are documented in the provided data for CVE-2026-101909. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog.