DEV Community

Ioneyrezende
Ioneyrezende

Posted on

Hardening Axios formSerializer After CVE-2026-101909

#security #vulnerability #axios #javascript

Hardening Axios formSerializer After CVE-2026-101909

CVE-2026-101909 shows why defaults inherited through JavaScript's prototype chain can become security inputs. Axios form serialization expects a set of options that control field naming, recursion, metadata tokens, and the visitor used during traversal. Affected versions read those values without requiring them to be own properties. The fix in 0.34.0 and 1.20.0 changes that behavior, but applications with custom form handling should also review how they configure formSerializer.

The official advisory describes a partial workaround for systems that cannot upgrade immediately. The caller can supply an own formSerializer object that explicitly sets visitor, maxDepth, dots, indexes, metaTokens, and Blob. An own property is present on the object itself, so a polluted value on Object.prototype does not replace it during the read.

Why a wrapper may not be enough

A local wrapper can provide safe defaults for one function, while another path calls Axios directly with no own options. That leaves the inherited-property problem intact. Search every route that can invoke form serialization, including shared request clients and framework adapters.

The explicit configuration should also match the receiver's schema. Setting dots to a fixed value prevents inherited changes, but the resulting field name must still match what the remote service expects. The same applies to indexes and metaTokens. Hardening a serializer with the wrong field convention can turn a security gadget into a functional bug.

A containment pattern

The safe pattern is to define the full set of behavior-affecting values on each call that uses form data. Avoid relying on an empty options object. If the application needs nested fields, set a maximum depth that matches its intended data model. If it uses a custom visitor, keep that function local and review it as security-sensitive code.

The workaround does not remove the prototype pollution source. It limits this specific read-side gadget. Continue searching for the component that allows writes to Object.prototype. Dependency review, input validation, and safe merge utilities remain necessary.

Upgrade behavior

The affected Axios ranges are 0.28.0 through versions below 0.34.0 and 1.15.1 through versions below 1.20.0. Use 0.34.0 or later for the 0.x line and 1.20.0 or later for the 1.x line.

The v0.34.0 release notes state that inherited properties no longer influence form serializer options and other request configuration. The v1.20.0 release notes describe broader runtime option hardening. After upgrading, remove containment code only after confirming that another dependency cannot pollute the process and that the request schema remains correct.

Validation checklist

  • Confirm the running artifact uses a patched Axios version.
  • Pass own formSerializer values on form requests that remain in use.
  • Test nested fields against the receiver's schema.
  • Search logs for ERR_FORM_DATA_DEPTH_EXCEEDED.
  • Review object merge code for prototype keys.
  • Verify that JSON-only services are not incorrectly treated as affected form clients.

Exposure context

ZoomEye Search app="Node.js" returned 5,547,929 fingerprint matches. The exact CVE Filter returned 0. This is a Node.js application fingerprint count, not a count of confirmed vulnerable Axios deployments.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOb2RlLmpzIg%3D%3D

The advisory gives the issue CVSS 4.0 score 8.3 and CWE-1321. No CISA KEV listing or confirmed in-the-wild exploitation was identified in the reviewed sources as of 2026-11-08. Hardening should focus on reachable form paths and the pollution source rather than the broad Node.js count.

Sources

Top comments (0)