CVE-2026-101907

The record

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled. This issue is fixed in version 1.20.0.

Affected packages

Related vulnerabilities

• CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
• CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
• CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
• CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
• CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-441
• CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
• CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud… CWE-441
• CVE-2026-84329 Confused deputy in CredentialProvider in Google Chrome on on Windows prior to… CWE-441