Most recent entries from all

EUVD-2026-380193

fkie_cve-2026-101909

Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure, Blob changes value handling, and a polluted visitor can execute when an attacker already has the stronger ability to inject a function. Serialized field naming and data interpretation can change, maxDepth can cause request failure, Blob can alter value handling, and a polluted visitor can execute under the stronger function-injection primitive. This issue is fixed in versions 0.34.0 and 1.20.0.

GHSA-x97p-jq2g-jp4f — Axios: Prototype Pollution Gadget in axios toFormData Options

Affected: npm: axios

## Summary

Axios form serialization reads `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob` from an internal options object without own-property guards. When `Object.prototype` has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.

Axios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures.

## Impact

The impact depends on which property is polluted and which axios serialization path the application uses.

Polluted `dots`, `indexes`, or `metaTokens` can change field names and cause the receiving service to parse different data than the caller intended. Polluted `maxDepth` can cause nested form submissions to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`, producing request-level or service-level denial of service for affected workflows. Polluted `visitor` can execute as the serializer visitor if an attacker can place a function on `Object.prototype`, but that condition generally implies a stronger same-process code-execution or malicious-dependency primitive and should be described carefully.

## Affected Functionality

Affected:

- `axios.toFormData()`. - `transformRequest` paths that serialize plain objects to `multipart/form-data`. - URL-encoded form serialization paths that rely on the same helper. - `formSerializer` option defaults when t…

RHSA-2026:74869 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization axios: axios: Unintended HTTP method override via prototype pollution gadget axios: Axios: Denial of Service via malformed data URLs axios: Axios: HTTP header injection via inherited prototype properties axios: axios: Request socket hijacking via inherited createConnection property axios: axios: Denial of Service via crafted redirect hostname axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution axios: axios: Denial of Service via prototype pollution gadget in form serialization

UBUNTU-CVE-2026-101909

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios