Description
Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetch(request, fetchOptions) instead of fetch(request, resolvedOptions).
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.7.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: Prototype pollution gadget in fetch adapter can alter outbound requests and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection - CVE-2026-101905
- Axios: Prototype pollution gadgets can alter axios request construction - CVE-2026-67316
- Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth - CVE-2026-101902
- Axios: Prototype Pollution Gadget in axios toFormData Options - CVE-2026-101909
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026