{"id":"EUVD-2026-88368","enisaUuid":"e6173976-453b-30e6-bc28-15b52a96a481","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","datePublished":"Sep 28, 2026, 5:14:07 PM","dateUpdated":"Sep 28, 2026, 5:49:13 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","references":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","aliases":"CVE-2026-101900\nGHSA-4hqw-qxg8-jxx2\n","assigner":"GitHub_M","epss":0.55,"enisaIdProduct":[{"id":"65f1538d-27db-30f0-82d0-336aeaa049b6","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.12.0, \u003c 1.20.0"}],"enisaIdVendor":[{"id":"23b03b60-5272-34ee-b4a6-9296b02dd860","vendor":{"name":"axios"}}],"enisaIdVulnerability":[{"id":"0d679874-f434-3a07-b817-5b3f82662919","vulnerability":{"id":"GHSA-4hqw-qxg8-jxx2","description":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","datePublished":"Sep 30, 2026, 3:34:46 PM","dateUpdated":"Sep 30, 2026, 3:34:46 PM","baseScore":0.0,"references":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101900\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","enisa_id":"EUVD-2026-88368\n","aliases":"GHSA-4hqw-qxg8-jxx2\nCVE-2026-101900\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8851265d-5d9c-3a69-8768-bded4f009f3a","vulnerability":{"id":"CVE-2026-101900","description":"Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.","datePublished":"Sep 28, 2026, 5:14:07 PM","dateUpdated":"Sep 28, 2026, 5:49:13 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","references":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2\nhttps://github.com/axios/axios/pull/11141\nhttps://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a\nhttps://github.com/axios/axios/releases/tag/v1.20.0\n","enisa_id":"EUVD-2026-88368\n","assigner":"GitHub_M","epss":0.55,"dataProcessed":"Oct 29, 2026, 7:15:20 AM","vulnerabilityProduct":[{"id":"709bac68-b8ee-35f8-9dbb-6386ebc918b7","product":{"name":"axios","vendor":{"name":"axios"}},"product_version":"1.12.0, \u003c 1.20.0"}],"vulnerabilityVendor":[{"id":"b4651084-6b5b-3d9f-882a-6aee1341da50","vendor":{"name":"axios"}}]}}],"enisaIdAdvisory":[{"id":"5dffd4c0-0569-32de-abb4-ad895f93e6ec","advisory":{"id":"RHSA-2026:74872","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:28:50 AM","dateUpdated":"Oct 2, 2026, 10:10:04 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74872\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74872.json\n","aliases":"CVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"5677a6f4-0876-3190-9eb3-bf33ae3ed729","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"5d0d3bcc-7c6f-31d5-a26e-c85fe4fbcfa0","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"8404d7c1-0658-3a75-9e99-bd5e7ef152b6","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"e99cd7f5-4cbb-3160-a1b4-5f027fdf7f41","product":{"name":"grafana13.2-0:13.2.1-0.9.hum1@src","vendor":{"name":"Red Hat"}}}]}},{"id":"91155903-5faf-332a-86a5-3693ab21bacd","advisory":{"id":"RHSA-2026:74871","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:22:42 AM","dateUpdated":"Oct 20, 2026, 6:59:04 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74871\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74871.json\n","aliases":"CVE-2026-93450\nCVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"32a0bc42-c51d-3255-b127-90a5d8f2f74c","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a8a45be7-b3a0-392e-a414-9600451710ea","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c60b5051-df3c-3814-ae79-08b8d0830dfc","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"c765192b-1a6d-3c0f-ae33-119949a1bf10","product":{"name":"grafana12.4-0:12.4.12-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"fe6f9308-468b-37ae-b179-29e314ad2d0d","advisory":{"id":"RHSA-2026:74869","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Oct 2, 2026, 10:17:34 AM","dateUpdated":"Oct 9, 2026, 7:19:43 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:74869\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74869.json\n","aliases":"CVE-2026-93981\nCVE-2026-101898\nCVE-2026-101900\nCVE-2026-101901\nCVE-2026-101902\nCVE-2026-101903\nCVE-2026-101904\nCVE-2026-101905\nCVE-2026-101906\nCVE-2026-101907\nCVE-2026-101908\nCVE-2026-101909\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"309bb809-5a04-31b0-bacc-1c5bdb079d1a","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"411112a7-0a4f-3960-8a84-c3c16d006628","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"a38b8c33-91ea-3e0b-a2e8-6cb0efb50ea1","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c2720006-1a98-3e01-8239-007a59ba305c","product":{"name":"grafana13.1-0:13.1.6-0.6.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}