CVE-2026-101902

The record

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch. This issue is fixed in version 0.34.0 and 1.20.0.

Affected packages

Related vulnerabilities

• CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-1321
• CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
• CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. CWE-1321
• CVE-2026-104183 stream-json is a micro-library of stream components for processing JSON and JSONC with a… CWE-1321
• CVE-2026-102992 piscina is a node.js worker pool implementation. CWE-1321
• CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
• CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321
• CVE-2026-101904 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1321