CVE-2026-101904

COMPONENT VERSION RANGE

NewScan fingerprints axios from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-29 (/daily-cve). ONE row for the whole batch on the Open WebUI / Langflow / iTop precedent - ten ids, one fix release, and ten rows would be ten findings that all say 'upgrade axios to 1.20.0'. The row's OWN id is CVE-2026-101904 because it is the only one affected across the entire range this row matches (1.0.0 until 1.20.0): dispatchRequest normalises an inherited Object.prototype.headers from a replaced prototype. The nine in `cves` share the 1.20.0 fix but each has its own floor inside the range - 101900 from 1.12.0, 101901 and 101898 from 1.13.0, 101908 from 1.7.0, 101906 from 1.15.0, 101909 from 1.15.1, 101905 from 1.15.2, 101903 from 1.16.1, 101907 from 1.17.0 - which is exactly what `cves` is for: it names ids the row covers WITHOUT version-matching them (docs/signature-packs.md section 3), and the version-matched claim is the primary id alone. CVE-2026-101902 is deliberately NOT listed here: NVD's 1.x bound for it is ambiguous in the feed text, so it sits only on the 0.x row below, where its range is stated unambiguously. Recorded `high`, not critical: the two that matter most on a server - 101898 (HTTP/2 request setup does not consistently apply proxy settings or caller-supplied options, so an allow-listed egress proxy is silently bypassed) and 101907 (the fetch adapter ignores maxRedirects: 0) - turn axios into an SSRF primitive, but only in an application that already routes a semi-trusted URL through it; the prototype-pollution set needs an attacker-influenced config object. VERSION SOURCE, named because a row without one is dead data: the mined manifest route. `mine_versions` fetches /package.json, /package-lock.json and /yarn.lock and joins concretely-pinned deps through `version_tools._techdb_names`, whose alias map is DERIVED from this pack's keys - `axios` is already a key, so this row is live the moment it publishes, no code. The retire.js in-page route (`analyze_technologies`) is NOT a source for this range and that is measured, not assumed: retirejs.scan only yields a component when its own corpus carries an advisory below that version, and the bundled corpus's highest axios bound is `below 1.16.0`, so a 1.16.1-1.19.x bundle returns []. A version-match-only row - confirming any of these in-band means driving the customer's own outbound requests.