Node axios: From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. (CVE-2026-101908)

Axios, a promise-based HTTP client for browsers and Node.js, versions 1.7.0 through 1.19.x have a vulnerability in the fetch adapter. The adapter constructs a Request object with sanitized resolvedOptions but then calls fetch with the original fetchOptions, which may include attacker-controlled headers due to a separate prototype pollution flaw affecting Object.prototype.headers. This causes the fetch call to use headers inherited from the polluted prototype, overriding sanitized headers and enabling manipulation of authorization, caching, metadata-service access, or application-specific behavior. The vulnerability is addressed in Axios version 1.20.0.

An attacker can control request headers that override sanitized headers, potentially impacting authorization, caching behavior, access to metadata services, or other application-specific functions relying on headers. This could lead to unauthorized access or manipulation of application behavior depending on header usage.

Upgrade Axios to version 1.20.0 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix is official and available.