Node axios: From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. (CVE-2026-101904)

Axios is a promise-based HTTP client for browsers and Node.js. In versions 1.0.0 through 1.19.x, the dispatchRequest function normalizes headers from a replacement request configuration, including inherited Object.prototype.headers. A separate prototype pollution vulnerability sets Object.prototype.headers, and when trusted interceptors return a configuration lacking an own headers property, dispatchRequest resolves inherited headers during normalization. This results in downstream processing using attacker-controlled headers, potentially including sensitive authorization headers. The vulnerability is addressed in Axios version 1.20.0.

An attacker who can exploit a same-process prototype pollution flaw to set Object.prototype.headers can influence the headers used in Axios HTTP requests. This can lead to unauthorized headers being included in requests, potentially exposing or manipulating authorization data. The vulnerability affects the integrity of request headers and could impact security controls relying on header values.

Upgrade Axios to version 1.20.0 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.