CVE-2026-101905 UNKNOWN

Mô tả

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0.

Sản phẩm bị ảnh hưởng

Nguồn dữ liệu chưa cung cấp thông tin sản phẩm chi tiết.

Tài liệu tham khảo

• [security-advisories@github.com] https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
• [security-advisories@github.com] https://github.com/axios/axios/pull/11141
• [security-advisories@github.com] https://github.com/axios/axios/releases/tag/v1.20.0
• [security-advisories@github.com] https://github.com/axios/axios/security/advisories/GHSA-m8m8-qj5v-23w3

Lịch sử thay đổi