Node axios: From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through… (CVE-2026-101909)

Axios, a promise-based HTTP client for browsers and Node.js, has a prototype pollution vulnerability in the ToFormData processing in versions 0.28.0 up to but not including 0.34.0 and 1.15.1 up to but not including 1.20.0. The vulnerability arises because ToFormData processes inherited serialization options and visitor properties that can be supplied through prototype pollution. This allows attackers to alter field naming and data interpretation, cause request failures by manipulating maxDepth, change value handling via Blob, or execute a polluted visitor function if they already have the ability to inject functions. The vulnerability is addressed in Axios versions 0.34.0 and 1.20.0.

The vulnerability can lead to altered request serialization behavior, causing unexpected field naming and data interpretation changes. It can also cause request failures by forcing maxDepth to problematic values. Additionally, if an attacker has the ability to inject functions, they may execute code via a polluted visitor property. This can impact the integrity and reliability of HTTP requests made using Axios in affected versions.

This vulnerability is fixed in Axios versions 0.34.0 and 1.20.0. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated or required according to the available data.