CVE-2026-101900 UNKNOWN

Mô tả

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior. This issue is fixed in version 1.20.0.

Sản phẩm bị ảnh hưởng

Nguồn dữ liệu chưa cung cấp thông tin sản phẩm chi tiết.

Tài liệu tham khảo

• [security-advisories@github.com] https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
• [security-advisories@github.com] https://github.com/axios/axios/pull/11141
• [security-advisories@github.com] https://github.com/axios/axios/releases/tag/v1.20.0
• [security-advisories@github.com] https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2
• [134c704f-9b21-4f2e-91b3-4a467353bcc0] https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2

Lịch sử thay đổi