EUVD-2026-88368Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process protot…

Historical advisory saved 30 Oct 2026 01:06:43 UTC. The publisher may have updated it since then. Latest advisory.

euvd · EUVD-2026-88368

Published

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 28, 2026, 5:14:07 PM

dateUpdated: Sep 28, 2026, 5:49:13 PM

3 related source bulletins · separate from aliases

RHSA-2026:74872: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-101898 · CVE-2026-101900 · CVE-2026-101901 · CVE-2026-101902 · CVE-2026-101903 · CVE-2026-101904 · CVE-2026-101905 · CVE-2026-101906 · CVE-2026-101907 · CVE-2026-101908 · CVE-2026-101909

RHSA-2026:74871: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-93450 · CVE-2026-101898 · CVE-2026-101900 · CVE-2026-101901 · CVE-2026-101902 · CVE-2026-101903 · CVE-2026-101904 · CVE-2026-101905 · CVE-2026-101906 · CVE-2026-101907 · CVE-2026-101908 · CVE-2026-101909

RHSA-2026:74869: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-93981 · CVE-2026-101898 · CVE-2026-101900 · CVE-2026-101901 · CVE-2026-101902 · CVE-2026-101903 · CVE-2026-101904 · CVE-2026-101905 · CVE-2026-101906 · CVE-2026-101907 · CVE-2026-101908 · CVE-2026-101909

Source published: Sep 28, 2026, 5:14:07 PM (timezone not stated)
Source modified: Sep 28, 2026, 5:49:13 PM (timezone not stated)
Saved here: 30 Oct 2026 01:06:43 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N