Node axios: From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. (CVE-2026-101905)

Axios, a promise-based HTTP client for Node.js, versions 1.15.2 through 1.19.x have a vulnerability in the Node HTTP adapter (lib/adapters/http.js) where the request options do not define their own createConnection property. Due to a separate prototype pollution flaw, an attacker can add a createConnection function to Object.prototype. When Axios resolves the createConnection property, it invokes the attacker-controlled function, enabling interception and manipulation of HTTP requests and responses. This can lead to exposure of sensitive data such as credentials. The vulnerability is fixed in Axios version 1.20.0.

An attacker exploiting this vulnerability can intercept and manipulate HTTP requests and responses transparently, potentially capturing sensitive information including credentials. The attack can be performed without altering the visible URL, making detection difficult. This compromises the confidentiality and integrity of HTTP communications made via the affected Axios versions.

Upgrade Axios to version 1.20.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Users should verify that their Axios dependency is updated to a fixed version to prevent exploitation.