DEV Community

StarkMan
StarkMan

Posted on

CVE-2026-101909 Impact Boundaries: Multipart, URL-Encoding, and Denial of Service

#security #vulnerability #axios #javascript

CVE-2026-101909 Impact Boundaries: Multipart, URL-Encoding, and Denial of Service

The impact of CVE-2026-101909 is easiest to understand when the affected and unaffected request paths are kept separate. Axios has a form serialization problem that becomes reachable when Object.prototype is already polluted. The advisory does not describe every Axios request as affected, and it does not treat the gadget as a complete exploit chain by itself.

Affected functionality

The affected paths are axios.toFormData(), transformRequest serialization of plain objects to multipart/form-data, URL-encoded form paths that use the same helper, and form serializer defaults when relevant properties are absent as own properties.

The vulnerable option reads are metaTokens, visitor, dots, indexes, Blob, and maxDepth. Inherited values can change the outgoing request body or cause it to fail before transmission.

Unaffected functionality

JSON request bodies are outside the described path. Requests that do not call toFormData() are also outside it. A process that has no prototype pollution does not meet the read-side precondition even if it runs an affected Axios version.

That does not make an affected dependency harmless. Applications can use multiple request paths. A service that normally sends JSON may still expose a file upload or form action that invokes the vulnerable serializer. Inventory should identify actual routes.

The three impact classes

Field-name changes are the first class. Inherited dots, indexes, or metaTokens values can alter how multipart or URL-encoded data appears to the receiver. The result may be rejected, ignored, or interpreted under a different schema.

Availability failures are the second class. An inherited maxDepth value can make nested form data exceed the serializer's limit and throw ERR_FORM_DATA_DEPTH_EXCEEDED. Repeated failures can interrupt normal workflows.

The third class is the function-valued visitor case. If an attacker can put a function on Object.prototype, the serializer can invoke it while processing fields. The advisory says this condition generally implies a stronger same-process primitive. Defenders should preserve that qualifier and investigate the actual injection mechanism.

Verification after a fix

Axios 0.34.0 and 1.20.0 are the fixed releases for the two affected ranges. After deployment, verify that the production artifact contains the correct version. Exercise a multipart request with nested fields and a URL-encoded request that uses the same helper. Compare the received field names with the documented schema.

Search runtime logs for serialization errors and unexpected form keys. If a custom formSerializer workaround remains, confirm that it sets own values for all relevant properties. Keep the workaround under review until the vulnerable package and pollution source are both removed.

Exposure scope

The selected Search Dork was app="Node.js". It returned 5,547,929 application fingerprint matches. The exact CVE Filter returned 0. Exposure is 5,547,929, but the count does not confirm vulnerable versions or polluted processes.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOb2RlLmpzIg%3D%3D

The advisory records CVSS 4.0 score 8.3 and CWE-1321. The reviewed sources did not show CISA KEV inclusion or confirmed in-the-wild exploitation as of 2026-11-08.

Sources

Top comments (0)