{"id":"CVE-2026-101900","kind":"vulnerability","aliases":["CVE-2026-101900","GHSA-4hqw-qxg8-jxx2"],"related":[],"title":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","description":"## Summary\r\n\r\nAxios contains a guard in the Node HTTP adapter to avoid using an inherited `Object.prototype.getHeaders` as a FormData header source. The fetch adapter calls the shared `resolveConfig()` helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes `Object.prototype` with FormData-like properties and `getHeaders()`, the fetch adapter can merge attacker-controlled headers into the outbound request.\r\n\r\nAxios does not create the prototype pollution source. This is a read-side gadget in the fetch adapter configuration path.\r\n\r\n## Impact\r\n\r\nAn attacker with a prior same-process prototype-pollution primitive can inject headers into fetch-adapter requests. Depending on the target service, this may affect authorization, metadata-service access, cache behavior, conditional request handling, or other application-specific header logic.\r\n\r\nPlain objects are blocked by current FormData detection. The confirmed path uses arrays or non-plain class instances whose prototype chain can resolve polluted FormData-like properties.\r\n\r\n## Affected Functionality\r\n\r\nAffected:\r\n\r\n- Fetch adapter requests.\r\n- `resolveConfig()` handling of `utils.isFormData(data)`.\r\n- Request bodies that can be spoofed as FormData through inherited `Symbol.toStringTag`, `append`, and `getHeaders`.\r\n\r\nNot affected:\r\n\r\n- Node HTTP adapter's later FormData header path, which checks `data.getHeaders !== Object.prototype.getHeaders`.\r\n- Plain object request bodies rejected by current `isFormData()` plain-object guard.\r\n- Processes without prototype pollution.\r\n\r\n## Technical Details\r\n\r\n`lib/helpers/resolveConfig.js` currently contains:\r\n\r\n```js\r\nif (utils.isFormData(data)) {\r\n  if (platform.hasStandardBrowserEnv || platform.hasStandardBrowserWebWorkerEnv || utils.isReactNative(data)) {\r\n    headers.setContentType(undefined);\r\n  } else if (utils.isFunction(data.getHeaders)) {\r\n    setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));\r\n  }\r\n}\r\n```\r\n\r\nUnlike `lib/adapters/http.js`, this code does not reject `Object.prototype.getHeaders`. Local verification on axios `1.18.1` polluted `Object.prototype[Symbol.toStringTag]`, `append`, and `getHeaders`, then sent an array body with `adapter: 'fetch'`. The loopback server received `X-Poisoned: yes`.\r\n\r\n## Proof of Concept of Attack\r\n\r\nConstrained local demonstration:\r\n\r\n```js\r\nObject.prototype[Symbol.toStringTag] = 'FormData';\r\nObject.prototype.append = function () {};\r\nObject.prototype.getHeaders = () => ({ 'X-Poisoned': 'yes' });\r\n\r\nawait axios.post(url, ['a', 'b'], { adapter: 'fetch' });\r\n```\r\n\r\nExpected safe behavior is that inherited `Object.prototype.getHeaders` is ignored. Current affected behavior merges the returned header.\r\n\r\n## Workarounds\r\n\r\nUse the Node HTTP adapter for server-side requests that may run in a polluted process. Avoid passing array or class-instance bodies through the fetch adapter when prototype pollution is suspected.\r\n\r\n<details>\r\n  <summary><h3>Original report</h3></summary>\r\n  \r\n## Summary\r\n\r\nThe Node HTTP adapter contains a guard that prevents `Object.prototype.getHeaders` from being used as a FormData header source. The shared `resolveConfig()` helper does not have the same guard. The fetch adapter calls `resolveConfig()`, so it can still merge headers returned by inherited `data.getHeaders()`.\r\n\r\nThis is a patch mismatch for the FormData prototype-pollution header-injection class.\r\n\r\n## Affected Version\r\n\r\nValidated on:\r\n\r\n- axios: `1.17.0`\r\n- commit: `4306df2`\r\n- runtime: Node.js `v24.15.0`\r\n\r\n## Preconditions\r\n\r\n- Application uses `adapter: 'fetch'`.\r\n- A separate prototype-pollution primitive can write:\r\n  - `Object.prototype[Symbol.toStringTag] = 'FormData'`\r\n  - `Object.prototype.append = function () {}`\r\n  - `Object.prototype.getHeaders = function () { ... }`\r\n- The request body is an array or custom class instance. Plain objects are blocked by the current `isFormData()` plain-object guard.\r\n\r\n## Root Cause\r\n\r\n`lib/adapters/http.js` contains:\r\n\r\n```js\r\ndata.getHeaders !== Object.prototype.getHeaders\r\n```\r\n\r\nBut `lib/helpers/resolveConfig.js` only checks:\r\n\r\n```js\r\n} else if (utils.isFunction(data.getHeaders)) {\r\n  setFormDataHeaders(headers, data.getHeaders(), own('formDataHeaderPolicy'));\r\n}\r\n```\r\n\r\nThe fetch adapter calls `resolveConfig(config)` before dispatching the request.\r\n\r\n## Impact\r\n\r\nAn attacker can inject arbitrary headers into fetch-adapter requests. This may be used to influence internal APIs, metadata services, cache behavior, or application-specific authorization checks.\r\n\r\n## Proof of Concept\r\n\r\n```js\r\nimport axios from './index.js';\r\nimport http from 'http';\r\n\r\nconst start = (handler) => new Promise((resolve) => {\r\n  const server = http.createServer((req, res) => {\r\n    let body = '';\r\n    req.on('data', (chunk) => (body += chunk));\r\n    req.on('end', () => handler(req, res, body));\r\n  });\r\n  server.listen(0, '127.0.0.1', () => resolve(server));\r\n});\r\n\r\nconst stop = (server) => new Promise((resolve) => server.close(resolve));\r\n\r\nconst hits = [];\r\nconst tag = Symbol.toStringTag;\r\n\r\nconst server = await start((req, res, body) => {\r\n  hits.push({ headers: req.headers, body });\r\n  res.setHeader('Content-Type', 'application/json');\r\n  res.end('{\"ok\":true}');\r\n});\r\n\r\ntry {\r\n  Object.prototype[tag] = 'FormData';\r\n  Object.prototype.append = function () {};\r\n  Object.prototype.getHeaders = () => {\r\n    const headers = Object.create(null);\r\n    headers['X-Poisoned'] = 'yes';\r\n    return headers;\r\n  };\r\n\r\n  await axios.post(`http://127.0.0.1:${server.address().port}/fetch-formdata`, ['a', 'b'], {\r\n    adapter: 'fetch',\r\n    timeout: 3000\r\n  });\r\n\r\n  console.log(hits[0]);\r\n} finally {\r\n  delete Object.prototype[tag];\r\n  delete Object.prototype.append;\r\n  delete Object.prototype.getHeaders;\r\n  await stop(server);\r\n}\r\n```\r\n\r\nObserved wire request:\r\n\r\n```json\r\n{\r\n  \"headers\": {\r\n    \"x-poisoned\": \"yes\",\r\n    \"content-type\": \"text/plain;charset=UTF-8\",\r\n    \"content-length\": \"3\"\r\n  },\r\n  \"body\": \"a,b\"\r\n}\r\n```\r\n\r\n## References\r\n\r\n- https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9\r\n- https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\r\n- Related patch area: `lib/adapters/http.js`, `lib/helpers/resolveConfig.js`\r\n</details>","summary":"When an attacker already has a prototype-pollution bug in the same Node.js process, axios's fetch adapter can merge attacker-chosen headers into outbound requests with array or class-instance bodies. The Node HTTP adapter blocks this path, but the shared resolveConfig helper used by the fetch adapter does not.","severity":"medium","cvss":6.9,"epss":0.00546,"exploited":false,"exploited_at":null,"products":[{"name":"axios","note":">=1.12.0","fixed":[">=1.20.0"],"affected":">= 1.12.0","ecosystem":"npm"},{"name":"axios","fixed":["1.20.0"],"affected":">= 1.12.0, < 1.20.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["axios","cwe-1321","cwe-693","cwe-74","fetch-adapter","node","npm","package"],"not_affected_if":["default-config","no-prototype-pollution","plain-object-bodies"],"how_to_check":"- Check the installed axios version with `npm ls axios`; versions from `1.12.0` up to but not including `1.20.0` are affected.\n- Search the code for `adapter: 'fetch'` in axios calls that send array or custom class-instance bodies.\n- Confirm whether the service has any prototype-pollution exposure, since the bug needs one.","fix":"- axios: upgrade to `1.20.0` or later.","status":"open","published_at":"2026-09-16T09:04:02+00:00","first_seen_at":"2026-11-09T22:53:19+00:00","triaged_at":"2026-11-09T23:00:36+00:00","updated_at":"2026-11-09T23:00:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T23:00:36Z","model":"claude-haiku-5-5","output":{"fix":"- axios: upgrade to `1.20.0` or later.","reach":"unknown","title":"Axios: fetch adapter can inject attacker headers after prototype pollution","impact":"medium","summary":"When an attacker already has a prototype-pollution bug in the same Node.js process, axios's fetch adapter can merge attacker-chosen headers into outbound requests with array or class-instance bodies. The Node HTTP adapter blocks this path, but the shared resolveConfig helper used by the fetch adapter does not.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","axios","node","fetch-adapter"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker-chosen headers sent on internal requests from the server","analyst_note":"","how_to_check":"- Check the installed axios version with `npm ls axios`; versions from `1.12.0` up to but not including `1.20.0` are affected.\n- Search the code for `adapter: 'fetch'` in axios calls that send array or custom class-instance bodies.\n- Confirm whether the service has any prototype-pollution exposure, since the bug needs one.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","plain-object-bodies","no-prototype-pollution"],"who_is_affected":"Only applications that use axios's fetch adapter, send array or custom class-instance request bodies through it, and run in a process that can also be prototype-polluted. Axios does not create the pollution itself, so a team with no prototype-pollution exposure is at much lower risk. Services that use the default Node HTTP adapter are not affected by this specific path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001026,"input_tokens":7105,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101900':12A,20A '-1321':25B '-2026':11A,19A '-693':27B '-74':29B '1.17.0':505C '1.18.1':339C '4306df2':507C '4hqw':15A 'access':205C 'adapt':3A,32B,54B,74B,87B,97C,111C,140C,169C,191C,251C,276C,352C,386C,409C,433C,445C,472C,514C 'affect':200C,247C,249C,273C,398C,500C 'alreadi':39B 'anoth':127C 'append':269C,343C 'applic':214C,512C 'application-specif':213C 'array':65B,230C,349C,424C,536C 'attack':38B,58B,144C,174C,366C 'attacker-chosen':57B 'attacker-control':143C 'author':201C 'avoid':99C,422C 'await':381C 'axio':1A,23B,51B,89C,151C,338C,504C 'axios':21A,22A 'axios.post':382C 'b':385C 'behavior':207C,390C,399C 'block':75B,221C,544C 'bodi':70B,259C,289C,350C,429C,533C 'bug':45B 'cach':206C 'call':112C,473C 'caus':554C 'chain':239C 'check':283C 'chosen':59B 'class':68B,235C,427C,499C,539C 'class-inst':67B,426C 'code':330C 'commit':506C 'concept':364C 'condit':208C 'configur':170C 'confirm':227C 'constrain':367C 'contain':90C,306C,446C 'control':145C 'creat':154C 'current':223C,292C,305C,397C,547C 'custom':538C 'cve':10A,18A 'cwe':24B,26B,28B 'data':257C,310C,315C 'data.getheaders':284C,321C,324C,484C 'demonstr':369C 'depend':193C 'detail':303C 'detect':225C 'dispatch':118C 'els':318C 'expect':388C 'fetch':2A,31B,53B,86B,110C,139C,168C,190C,250C,353C,387C,432C,471C,515C 'fetch-adapt':30B,189C 'formdata':8A,106C,133C,224C,244C,265C,279C,373C,457C,492C,526C 'formdata-lik':132C,243C 'formdataheaderpolici':326C 'function':248C,375C,528C,530C 'gadget':165C 'gethead':9A,137C,271C,345C 'ghsa':14A 'ghsa-4hqw-qxg8-jxx2':13A 'guard':92C,125C,297C,448C,469C,552C 'handl':210C,254C 'header':4A,60B,107C,146C,187C,216C,280C,323C,403C,458C,480C,497C 'header-inject':496C 'headers.setcontenttype':316C 'helper':82B,116C,121C,463C 'http':73B,96C,275C,408C,444C 'ignor':396C 'impact':172C 'inherit':7A,102C,267C,393C,483C 'inject':5A,186C,498C 'instanc':69B,236C,428C,540C 'isformdata':293C,548C 'js':307C,370C 'jxx2':17A 'lack':122C 'later':278C 'lib/adapter':555C 'lib/adapters/http.js':328C 'lib/helpers/resolveconfig.js':304C 'like':134C,245C 'local':335C,368C 'logic':217C 'loopback':355C 'may':199C,416C 'merg':56B,142C,400C,479C 'metadata':203C 'metadata-servic':202C 'mismatch':489C 'node':33B,72B,95C,274C,407C,443C 'node.js':49B,509C 'non':233C 'non-plain':232C 'npm':34B 'object':219C,287C,296C,542C,551C 'object.prototype':130C,341C,371C,524C 'object.prototype.append':374C,527C 'object.prototype.getheaders':103C,285C,334C,376C,394C,451C,529C 'origin':439C 'outbound':62B,149C 'packag':35B 'pass':423C 'patch':488C 'path':77B,171C,228C,281C 'plain':218C,234C,286C,295C,541C,550C 'plain-object':294C,549C 'platform.hasstandardbrowserenv':312C 'platform.hasstandardbrowserwebworkerenv':313C 'poison':360C,379C 'pollut':44B,129C,157C,183C,242C,301C,340C,420C,436C,495C,520C 'precondit':511C 'prevent':450C 'primit':184C,521C 'prior':177C 'process':50B,180C,298C,421C 'proof':362C 'properti':135C,246C 'prototyp':43B,156C,182C,238C,300C,435C,494C,519C 'prototype-pollut':42B,181C,493C,518C 'qxg8':16A 'read':163C 'read-sid':162C 'receiv':357C 'reject':290C,333C 'report':440C 'request':63B,150C,192C,209C,252C,258C,288C,414C,532C 'resolv':241C 'resolveconfig':81B,115C,253C,462C,474C 'return':402C,481C 'root':553C 'run':417C 'runtim':508C 'safe':389C 'same-process':178C 'sent':347C 'separ':517C 'server':356C,412C 'server-sid':411C 'servic':197C,204C 'setformdatahead':322C 'share':80B,114C,461C 'side':164C,413C 'sourc':108C,158C,459C 'specif':215C 'spoof':263C 'still':478C 'summari':88C,441C 'suspect':438C 'symbol.tostringtag':268C,342C,372C,525C 'target':196C 'technic':302C 'undefin':317C 'unlik':327C 'url':383C 'use':83B,100C,229C,405C,454C,513C 'utils.isformdata':256C,309C 'utils.isfunction':320C 'utils.isreactnative':314C 'v24.15.0':510C 'valid':502C 'verif':336C 'version':501C 'via':6A 'vulner':128C 'whose':237C 'without':299C 'workaround':404C 'write':523C 'x':359C,378C 'x-poison':358C,377C 'yes':361C,380C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use axios's fetch adapter, send array or custom class-instance request bodies through it, and run in a process that can also be prototype-polluted. Axios does not create the pollution itself, so a team with no prototype-pollution exposure is at much lower risk. Services that use the default Node HTTP adapter are not affected by this specific path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["axios"],"ptokens":["axios"],"labels":["axios","cwe1321","cwe693","cwe74","fetchadapter","medium","node","npm","package"],"campaign_type":null,"search_a":"'-101900':12A,20A '-2026':11A,19A '4hqw':15A 'adapt':3A 'axio':1A 'axios':21A,22A 'cve':10A,18A 'fetch':2A 'formdata':8A 'gethead':9A 'ghsa':14A 'ghsa-4hqw-qxg8-jxx2':13A 'header':4A 'inherit':7A 'inject':5A 'jxx2':17A 'qxg8':16A 'via':6A","search_b":"'-1321':25B '-693':27B '-74':29B 'adapt':32B,54B,74B,87B 'alreadi':39B 'array':65B 'attack':38B,58B 'attacker-chosen':57B 'axio':23B,51B 'block':75B 'bodi':70B 'bug':45B 'chosen':59B 'class':68B 'class-inst':67B 'cwe':24B,26B,28B 'fetch':31B,53B,86B 'fetch-adapt':30B 'header':60B 'helper':82B 'http':73B 'instanc':69B 'merg':56B 'node':33B,72B 'node.js':49B 'npm':34B 'outbound':62B 'packag':35B 'path':77B 'pollut':44B 'process':50B 'prototyp':43B 'prototype-pollut':42B 'request':63B 'resolveconfig':81B 'share':80B 'use':83B","search_c":"'1.17.0':505C '1.18.1':339C '4306df2':507C 'access':205C 'adapt':97C,111C,140C,169C,191C,251C,276C,352C,386C,409C,433C,445C,472C,514C 'affect':200C,247C,249C,273C,398C,500C 'anoth':127C 'append':269C,343C 'applic':214C,512C 'application-specif':213C 'array':230C,349C,424C,536C 'attack':144C,174C,366C 'attacker-control':143C 'author':201C 'avoid':99C,422C 'await':381C 'axio':89C,151C,338C,504C 'axios.post':382C 'b':385C 'behavior':207C,390C,399C 'block':221C,544C 'bodi':259C,289C,350C,429C,533C 'cach':206C 'call':112C,473C 'caus':554C 'chain':239C 'check':283C 'class':235C,427C,499C,539C 'class-inst':426C 'code':330C 'commit':506C 'concept':364C 'condit':208C 'configur':170C 'confirm':227C 'constrain':367C 'contain':90C,306C,446C 'control':145C 'creat':154C 'current':223C,292C,305C,397C,547C 'custom':538C 'data':257C,310C,315C 'data.getheaders':284C,321C,324C,484C 'demonstr':369C 'depend':193C 'detail':303C 'detect':225C 'dispatch':118C 'els':318C 'expect':388C 'fetch':110C,139C,168C,190C,250C,353C,387C,432C,471C,515C 'fetch-adapt':189C 'formdata':106C,133C,224C,244C,265C,279C,373C,457C,492C,526C 'formdata-lik':132C,243C 'formdataheaderpolici':326C 'function':248C,375C,528C,530C 'gadget':165C 'gethead':137C,271C,345C 'guard':92C,125C,297C,448C,469C,552C 'handl':210C,254C 'header':107C,146C,187C,216C,280C,323C,403C,458C,480C,497C 'header-inject':496C 'headers.setcontenttype':316C 'helper':116C,121C,463C 'http':96C,275C,408C,444C 'ignor':396C 'impact':172C 'inherit':102C,267C,393C,483C 'inject':186C,498C 'instanc':236C,428C,540C 'isformdata':293C,548C 'js':307C,370C 'lack':122C 'later':278C 'lib/adapter':555C 'lib/adapters/http.js':328C 'lib/helpers/resolveconfig.js':304C 'like':134C,245C 'local':335C,368C 'logic':217C 'loopback':355C 'may':199C,416C 'merg':142C,400C,479C 'metadata':203C 'metadata-servic':202C 'mismatch':489C 'node':95C,274C,407C,443C 'node.js':509C 'non':233C 'non-plain':232C 'object':219C,287C,296C,542C,551C 'object.prototype':130C,341C,371C,524C 'object.prototype.append':374C,527C 'object.prototype.getheaders':103C,285C,334C,376C,394C,451C,529C 'origin':439C 'outbound':149C 'pass':423C 'patch':488C 'path':171C,228C,281C 'plain':218C,234C,286C,295C,541C,550C 'plain-object':294C,549C 'platform.hasstandardbrowserenv':312C 'platform.hasstandardbrowserwebworkerenv':313C 'poison':360C,379C 'pollut':129C,157C,183C,242C,301C,340C,420C,436C,495C,520C 'precondit':511C 'prevent':450C 'primit':184C,521C 'prior':177C 'process':180C,298C,421C 'proof':362C 'properti':135C,246C 'prototyp':156C,182C,238C,300C,435C,494C,519C 'prototype-pollut':181C,493C,518C 'read':163C 'read-sid':162C 'receiv':357C 'reject':290C,333C 'report':440C 'request':150C,192C,209C,252C,258C,288C,414C,532C 'resolv':241C 'resolveconfig':115C,253C,462C,474C 'return':402C,481C 'root':553C 'run':417C 'runtim':508C 'safe':389C 'same-process':178C 'sent':347C 'separ':517C 'server':356C,412C 'server-sid':411C 'servic':197C,204C 'setformdatahead':322C 'share':114C,461C 'side':164C,413C 'sourc':108C,158C,459C 'specif':215C 'spoof':263C 'still':478C 'summari':88C,441C 'suspect':438C 'symbol.tostringtag':268C,342C,372C,525C 'target':196C 'technic':302C 'undefin':317C 'unlik':327C 'url':383C 'use':100C,229C,405C,454C,513C 'utils.isformdata':256C,309C 'utils.isfunction':320C 'utils.isreactnative':314C 'v24.15.0':510C 'valid':502C 'verif':336C 'version':501C 'vulner':128C 'whose':237C 'without':299C 'workaround':404C 'write':523C 'x':359C,378C 'x-poison':358C,377C 'yes':361C,380C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-16T09:04:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-4hqw-qxg8-jxx2","url":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","severity":"medium","published_at":"2026-09-16T09:04:02+00:00","modified_at":"2026-09-28T17:13:27+00:00","first_seen_at":"2026-11-09T22:53:19+00:00","fetched_at":"2026-11-09T22:53:19+00:00","note":null},{"source":"ghsa","external_id":"GHSA-4hqw-qxg8-jxx2","url":"https://github.com/advisories/GHSA-4hqw-qxg8-jxx2","severity":"medium","published_at":"2026-09-30T15:34:46+00:00","modified_at":"2026-09-30T15:34:47+00:00","first_seen_at":"2026-11-09T22:57:50+00:00","fetched_at":"2026-11-09T22:57:50+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-101900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900","severity":null,"published_at":"2026-09-28T18:17:18+00:00","modified_at":"2026-09-30T19:38:27+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110492,"url":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-16T09:04:02+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":110850,"url":"https://api.github.com/repos/axios/axios/security-advisories/GHSA-4hqw-qxg8-jxx2","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":110804,"url":"https://github.com/axios/axios/pull/11141","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110805,"url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":110808,"url":"https://github.com/axios/axios/releases/tag/v1.20.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.00546,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101900"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}