# CVE-2026-101909

Prototype-pollution in Axios toFormData can alter serialization and enable code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-101909
- CVSS: 8.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.50% (percentile 43.1)
- CISA SSVC: exploitation poc, automatable yes, technical impact total (assessed 2026-10-01)
- Weakness: CWE-1321
- Also known as: GHSA-x97p-jq2g-jp4f
- Published: 2026-09-28

## Affected versions

- axios: affected >= 1.15.1 and < 1.20.0; >= 0.28.0 and < 0.34.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Prototype pollution lets attackers change form-field naming/data, cause request failures, alter Blob handling, and—when combined with function-injection—execute code (potential RCE).

## Action

Patch when possible

## Recommendation

Upgrade to axios >=0.34.0 or >=1.20.0; audit dependency trees.

## References

- [other] https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f
- [other] https://github.com/axios/axios/pull/11141
- [other] https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a
- [other] https://github.com/axios/axios/commit/d29be181f85f6fe93397a07b1f69606d9622637b
- [other] https://github.com/axios/axios/releases/tag/v0.34.0
- [other] https://github.com/axios/axios/releases/tag/v1.20.0

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.