Description
Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig() helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes Object.prototype with FormData-like properties and getHeaders(), the fetch adapter can merge attacker-controlled headers into the outbound request.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.12.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Header Injection via Inherited headers After Minimal Interceptor - CVE-2026-101904
- Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - CVE-2026-40175
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions - CVE-2026-44490
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026