CVE-2026-101908: falha de média gravidade em axios
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.4%
probabilidade de exploração
0.4%top 67% das CVEs
exploração observada
nãonenhuma fonte reporta
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior. This issue is fixed in version 1.20.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N
Produtos afetados
axios · axiosCVEs relacionadas — axios
No mesmo produto, das mais perigosas para as menos.
CVE-2019-10742—CVE-2019-10742EPSS 6.1%CVE-2026-25639HIGHAxios affected by Denial of Service via __proto__ Key in mergeConfigEPSS 2.0%CVE-2026-40175MEDIUMAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainEPSS 1.3%CVE-2025-62718MEDIUMAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFEPSS 1.2%CVE-2025-58754HIGHAxios is vulnerable to DoS attack through lack of data size checkEPSS 1.1%CVE-2026-44495HIGHAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeEPSS 1.0%