CVE-2026-101909

{
  "etk_id": "ETK-2026-72",
  "cve_id": "CVE-2026-101909",
  "display_id": "CVE-2026-101909",
  "ghsa_id": "GHSA-x97p-jq2g-jp4f",
  "euvd_id": "EUVD-2026-88392",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Prototype-pollution option inheritance in axios form serialization",
  "summary": "Axios releases from 0.28.0 before 0.34.0 and from 1.15.1 before 1.20.0 can use prototype-inherited settings while serializing multipart or URL-encoded form data. An attacker who has already polluted Object.prototype in the same process may alter serialized fields or cause affected requests to fail; JSON requests and paths that do not serialize form data are unaffected.",
  "mitigation": "Upgrade axios to 0.34.0 or later on the 0.x line, or to 1.20.0 or later on the 1.x line. Until upgrading, avoid form serialization in processes with known prototype pollution and explicitly provide serializer settings as own properties.",
  "vendor": "npm",
  "product": "npm:axios",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.28.0, < 0.34.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "0.34.0"
      ],
      "package_name": "axios",
      "purl": "pkg:npm/axios"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.15.1, < 1.20.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.20.0"
      ],
      "package_name": "axios",
      "purl": "pkg:npm/axios"
    }
  ],
  "cwes": [
    1321
  ],
  "cvss_score": 8.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2767,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 12.896652833333333,
  "t0_at": "2026-09-28T17:42:40.203000+00:00",
  "signals": {
    "check": {
      "at": "2026-09-30T15:42:48.117494+00:00",
      "days": 1.9167582696064815,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:42:40.203000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-09-30T15:02:45+00:00",
      "days": 1.888944409722222,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:42:40.203000+00:00",
      "url": "https://github.com/advisories/GHSA-x97p-jq2g-jp4f"
    },
    "trigger_signal": {
      "at": "2026-09-28T17:42:40.203000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-28T17:42:40.203000+00:00",
      "url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"
    }
  }
}