An Axios dependency can be difficult to see in a deployed JavaScript service. It may arrive through a framework, a generated client, a front-end build, or a shared internal package. CVE-2026-101909 makes that visibility problem concrete because the vulnerable behavior appears only when form serialization runs in a polluted process.

The affected ranges are Axios 0.28.0 through versions below 0.34.0 and Axios 1.15.1 through versions below 1.20.0. Fixed releases are 0.34.0 and 1.20.0. A useful inventory should record the resolved version, the code path that invokes Axios, and whether the process accepts untrusted object keys.

Build an application-focused inventory

Start with the package manager's resolved dependency graph. Search for Axios in lockfiles and production artifacts. Then identify the services that call form serialization. A dependency finding with no reachable form path is lower priority than a service that accepts multipart uploads and merges user-controlled objects.

Do not rely on a source search for the package name alone. Bundlers can rename modules, and wrappers can hide the import. Check runtime package metadata, container layers, and front-end assets. If a service publishes a software bill of materials, compare the listed Axios version with the artifact actually deployed.

Find the form paths

Search for direct axios.toFormData() calls and for request configurations that set Content-Type: multipart/form-data or URL-encoded form headers. Include custom hooks and helpers that preprocess request data. A framework extension may call the form helper without exposing the Axios name in application code.

Then inspect how the application builds nested objects. A path that copies user-controlled keys into a plain object can create both the pollution source and the data that reaches the serializer. Review validation code for prototype keys and object merge behavior.

Detect runtime effects

The advisory describes field-name changes and request failures. A receiver may see an unexpected form key, a missing field, or a nested submission that never arrives. The client may record ERR_FORM_DATA_DEPTH_EXCEEDED when inherited depth settings are too restrictive.

Logging should capture the generated request schema when it is safe to do so. Do not log sensitive values. Record field names, content type, request outcome, and serialization error codes. Correlate those events with dependency changes and prototype pollution findings in the same process.

Interpret ZoomEye Exposure

The selected ZoomEye query was:

app="Node.js"

It returned 5,547,929 application fingerprint matches. The exact CVE Filter returned 0. Exposure is 5,547,929, but the result describes Node.js fingerprints and does not identify vulnerable Axios packages, form routes, or polluted processes.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJOb2RlLmpzIg%3D%3D

The reviewed sources did not show CISA KEV inclusion or confirmed in-the-wild exploitation. That makes the inventory and version check the primary evidence, rather than external scanning alone.

Remediation decisions

Upgrade the affected package. Remove the prototype pollution source. If the upgrade must wait, avoid form serialization of attacker-controlled objects in the polluted process and pass an own formSerializer configuration with explicit safe values.

After deployment, verify that the running artifact contains 0.34.0 or later on the 0.x branch, or 1.20.0 or later on the 1.x branch. Re-run a nested form test and confirm that the intended field names reach the receiver. The CVE has CVSS 4.0 score 8.3 and CWE-1321, so inventory evidence should be retained with the remediation record.

Sources

  • Axios advisory: https://github.com/axios/axios/security/advisories/GHSA-x97p-jq2g-jp4f

  • Axios 0.34.0 release: https://github.com/axios/axios/releases/tag/v0.34.0

  • Axios 1.20.0 release: https://github.com/axios/axios/releases/tag/v1.20.0

  • CVE record: https://www.cve.org/CVERecord?id=CVE-2026-101909

  • CERT-FR advisory: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1378/