---
id: "CVE-2026-101902"
page: "https://infrastack.ai/live/CVE-2026-101902"
kind: "vulnerability"
aliases: ["CVE-2026-101902", "GHSA-9fr6-4gfg-395g"]
title: "Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method"
severity: "medium"
cvss: 6.9
epss: 0.00414
exploited: false
status: "open"
category: "package"
products: [{"name": "axios", "note": ">=0.27.2", "fixed": [">=0.34.0"], "affected": ">= 0.27.2", "ecosystem": "npm"}, {"name": "axios", "note": ">=1.0.0", "fixed": [">=1.20.0"], "affected": ">= 1.0.0", "ecosystem": "npm"}, {"name": "axios", "fixed": ["0.34.0"], "affected": ">= 0.27.2, < 0.34.0", "ecosystem": "npm"}, {"name": "axios", "fixed": ["1.20.0"], "affected": ">= 1.0.0, < 1.20.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["axios", "backend", "cwe-1321", "frontend", "node.js", "npm", "package"]
not_affected_if: ["created-instance", "explicit-method", "method-aliases", "no-prototype-pollution"]
published_at: "2026-09-16T09:00:51+00:00"
first_seen_at: "2026-11-09T22:53:19+00:00"
updated_at: "2026-11-09T23:00:41+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g", "first_seen_at": "2026-11-09T22:53:19+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-9fr6-4gfg-395g", "first_seen_at": "2026-11-09T22:57:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101902", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00414, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-101902"}]
---

# Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

Link for people: https://infrastack.ai/live/CVE-2026-101902 (this .md is for agents)

Axios reads its default HTTP method from an inherited Object.prototype property when a request omits a method, so a separate prototype-pollution bug in the same process can make calls like axios.request({ url }) send DELETE, POST or PUT instead of GET. Axios does not create the pollution itself; it turns an existing pollution into state-changing requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:axios affected >= 0.27.2 fixed >=0.34.0
- npm:axios affected >= 1.0.0 fixed >=1.20.0
- npm:axios affected >= 0.27.2, < 0.34.0 fixed 0.34.0
- npm:axios affected >= 1.0.0, < 1.20.0 fixed 1.20.0

## How to check

- Check the installed axios version with `npm ls axios` and compare it to the fixed ranges below.
- Search the application for calls to the default instance without a method, such as `axios.request({ url })` or `axios({ url })`.
- Look for any code path that merges untrusted input into objects with recursive merge or assign, since that is the usual source of prototype pollution.

## Fix

- axios `>=0.34.0` for the 0.x line (fixed in `0.34.0`)
- axios `>=1.20.0` for the 1.x line (fixed in `1.20.0`)

## Timeline

- 2026-11-09T22:53:19+00:00 ghsa-repo https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g
- 2026-11-09T22:57:50+00:00 ghsa https://github.com/advisories/GHSA-9fr6-4gfg-395g
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101902

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/axios/axios/security-advisories/GHSA-9fr6-4gfg-395g
- [fix] Patch: github.com https://github.com/axios/axios/pull/11141
- [fix] Patch: github.com https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- [fix] Release: github.com https://github.com/axios/axios/releases/tag/v0.34.0
- [fix] Release: github.com https://github.com/axios/axios/releases/tag/v1.20.0

## From the sources

## Summary

Axios default-instance requests that omit an explicit method can read an inherited `method` value from `Object.prototype`. If another vulnerability in the same process pollutes `Object.prototype.method`, calls such as `axios.request({ url })` and `axios({ url })` can send a state-changing HTTP method instead of the expected default `GET`.

Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch.

## Impact

In an affected application with a separate prototype-pollution primitive, an attacker can change axios default-instance requests that omit `method` from `GET` to methods such as `DELETE`, `POST`, `PUT`, or `PATCH`. The practical impact depends on the target endpoint and can include unintended writes, deletion, or other state changes.

Method aliases such as `axios.get(url)` and requests with an explicit own `method` are not affected by the confirmed method path.

## Affected Functionality

Affected:

- Default axios instance calls: `axios.request({ url })`.
- Callable shorthand: `axios({ url })`.
- Requests where no own `config.method` is provided.

Not affected in the confirmed method PoC:

- `axios.get(url)` and other method aliases.
- `axios.request({ url, method: 'GET' })`.
- `axios.create().request({ url })` when the created instance defaults are produced by current `mergeConfig()` and do not inherit from `Object.prototype`.

## Technical Details

`lib/core/Axios.js` sets the request method with:

```js
config.method = (config.method || this.defaults.method || 'get').toLowerCase();
```

`mergeConfig()` now returns a null-prototype request config, so `config.method` is safe from `Object.prototype`. However, the default axios instance stores the module defaults object as `this.defaults`, and that defaults object is a normal object. If `Object.prototype.method` exists, `this.defaults.method` resolves to the polluted inherited value.

Local verification on axios `1.18.1` showed a default-instance `axios.request({ url })` request reaching a loopback server as `DELETE` after `Object.prototype.method = 'DELETE'`.

## Proof of Concept of Attack

Constrained local demonstration:

```js
Object.prototype.method = 'DELETE';
try {
  await axios.request({ url: 'http://127.0.0.1:<port>/resource' });
} finally {
  delete Object.prototype.method;
}
```

Expected safe behavior is a `GET` request. Current affected behavior sends `DELETE` on the default instance when no method is provided.

## Workarounds

Use explicit method aliases such as `axios.get()` or set an own `method` on request configs. Avoid default-instance shorthand for requests in processes where prototype pollution is suspected or possible.

<details>
  <summary><h3>Original report</h3></summary>
  
### Summary

Axios `1.17.0` contains a read-side prototype-pollution gadget in the default Axios instance. If another vulnerability in the same Node.js process pollutes `Object.prototype.method`, default-instance calls such as `axios.request({ url })` and `axios({ url })` can be forced to use an attacker-controlled HTTP method, such as `DELETE`, instead of the expected default `GET`.

Axios does not create the prototype pollution by itself. The issue is that Axios reads fallback values from `this.defaults` without an own-property guard, allowing inherited values from `Object.prototype` to influence request behavior.

This should be treated as a prototype-pollution gadget, not as a standalone prototype-pollution source. In other words, Axios is not the component that lets the attacker write to `Object.prototype`; Axios is the component that becomes dangerous after `Object.prototype` has already been polluted by another bug in the same process.

### Details

The vulnerable fallback read is in `lib/core/Axios.js`:

```js
// Set config.allowAbsoluteUrls
if (config.allowAbsoluteUrls !== undefined) {
  // do nothing
} else if (this.defaults.allowAbsoluteUrls !== undefined) {
  config.allowAbsoluteUrls = this.defaults.allowAbsoluteUrls;
} else {
  config.allowAbsoluteUrls = true;
}

// Set config.method
config.method = (config.method || this.defaults.method || 'get').toLowerCase();
```

The merged request `config` is created as a null-prototype object in `lib/core/mergeConfig.js`:

```js
const config = Object.create(null);
```

Therefore, when the caller does not provide `config.method`, the fallback becomes:

```js
this.defaults.method
```

The default Axios instance uses the module defaults object. In the tested version, that defaults object is affected by inherited properties from `Object.prototype`. If `Object.prototype.method` is polluted, `this.defaults.method` resolves to that inherited value and Axios uses it as the request method.

The same unsafe inherited-property pattern also affects `this.defaults.allowAbsoluteUrls`, which can change how absolute URLs are combined with `baseURL`.

### Proof of Concept

#### Access and Attack Conditions

No admin access is required for Axios itself. This is a library-level gadget.

The attacker must have an existing way to pollute `Object.prototype` in the same Node.js process, for example through a separate prototype-pollution vulnerability in another dependency or application input path. Axios is the gadget that turns that pollution into dangerous HTTP request behavior.

Required condition:

```text
Some other bug or unsafe merge path in the application must allow Object.prototype pollution.
```

What Axios contributes:

```text
Axios reads inherited Object.prototype.method through this.defaults.method and uses it as the HTTP method fallback.
```

What Axios does not do:

```text
Axios does not create Object.prototype pollution by itself.
```

Affected usage:

```js
axios.request({ url });
axios({ url });
```

Not affected in the confirmed PoC:

```js
axios.get(url);
axios.request({ url, method: "GET" });
axios.create().request({ url });
```

#### Reproduction Steps

1. Create a clean test directory and install Axios `1.17.0`:

```powershell
mkdir axios-validation
cd axios-validation
npm init -y
npm install axios@1.17.0 --no-audit --no-fund
```

2. Save the method override PoC below as:

```text
validate-prototype-method-gadget.mjs
```

3. Run the PoC:

```powershell
node validate-prototype-method-gadget.mjs
```

4. Confirm that the output shows:

```text
defaultRequestMethod=DELETE
defaultShorthandMethod=DELETE
getAliasMethod=GET
explicitGetMethod=GET
createdInstanceMethod=GET
RESULT: CONFIRMED
```

5. This proves that after `Object.prototype.method = "DELETE"`, default-instance calls that omit an explicit method are sent as `DELETE`.

#### What the Method PoC Script Does

The PoC starts a temporary local HTTP server for each Axios call and records the HTTP method received by that server. It then simulates an already-existing prototype-pollution condition by setting:

```js
Object.prototype.method = "DELETE";
```

While that pollution is active, the script sends five Axios requests:

```js
axios.request({ url });                 // expected vulnerable path
axios({ url });                         // expected vulnerable shorthand path
axios.get(url);                         // expected safe alias path
axios.request({ url, method: "GET" });  // expected safe explicit-method path
axios.create().request({ url });        // expected safe isolated-instance path
```

The script then deletes the polluted property:

```js
delete Object.prototype.method;
```

Finally, it prints the method observed by the local server for each request. The vulnerable behavior is confirmed when the default Axios instance sends `DELETE` for `axios.request({ url })` and `axios({ url })`, while the safe comparison paths still send `GET`.

#### Method Override PoC

Create `validate-prototype-method-gadget.mjs`:

```js
impor

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_