Node axios: From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from… (CVE-2026-101902)

Axios, a promise-based HTTP client for browsers and Node.js, has a vulnerability in versions from 0.27.2 up to but not including 0.34.0 and 1.20.0 where requests without an explicit HTTP method can read an inherited method value from Object.prototype. If Object.prototype.method is polluted by another vulnerability in the same process, axios requests may send state-changing HTTP methods instead of the expected default GET. Axios itself does not cause the prototype pollution but acts as a read-side gadget in the request dispatch. This vulnerability is resolved in versions 0.34.0 and 1.20.0.

An attacker who can cause Object.prototype.method to be polluted in the same process may trigger axios requests without explicit methods to use unintended HTTP methods, potentially causing state-changing operations. This could lead to unexpected behavior or security issues depending on the context of the axios usage. Axios itself does not introduce prototype pollution but can be exploited if another vulnerability exists in the environment.

Upgrade axios to version 0.34.0 or later, or 1.20.0 or later, where this issue is fixed. No other specific mitigations are indicated. Patch status is confirmed fixed in these versions.