Node axios: From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. (CVE-2026-101900)

Axios, a promise-based HTTP client for Node.js and browsers, versions 1.12.0 through 1.19.x contain a vulnerability where the ResolveConfig function reads inherited properties such as Symbol.toStringTag, append, and getHeaders while resolving FormData headers. A separate prototype pollution flaw allows an attacker to supply an array or non-plain class instance with inherited properties that mimic FormData, bypassing plain object checks. The inherited getHeaders function can return attacker-controlled headers, which ResolveConfig merges into fetch adapter requests. This can lead to unauthorized modification of request headers affecting authorization, caching, metadata service, or other application-specific behaviors. The vulnerability is resolved in Axios version 1.20.0.

An attacker can manipulate HTTP request headers by exploiting this vulnerability, potentially altering authorization tokens, cache controls, metadata service requests, or other application-specific header-based behaviors. This can lead to unauthorized access or manipulation of application logic relying on these headers. There is no indication of remote code execution or direct data exfiltration from this vulnerability alone.

Upgrade Axios to version 1.20.0 or later, where this vulnerability is fixed. No other mitigations are indicated or required by the vendor advisory.