CVE-2026-101909

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.004; 27th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 101; of 17,966 indexed, latest versions
Container images: 83; deployed by those charts
Fix available: 1 of 1; affected package

Axios: Prototype Pollution Gadget in axios toFormData Options

Carried by container images the latest versions of 101 of 17,966 indexed charts deploy, on 83 images.

Affected package	Affected versions	Fixed in	Images
axiosnpm	0.28.0, 0.28.1, 0.30.0, 0.30.2+12 more	0.34.0, 1.20.0	83

OSV records: GHSA-x97p-jq2g-jp4f

Charts affected

101 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-101909.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	axios@0.28.1	0.34.0

Open the chart page →

9,849

Container images carrying it

83 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
n8nio/n8n :2.25.7	761374d4eb84	axios@1.16.1	1.20.0	1
n8nio/n8n :2.40.5	9f693fd55655	axios@1.18.0	1.20.0	1
n8nio/n8n :2.36.8	cfe2704ff858	axios@1.18.0	1.20.0	1
n8nio/n8n :2.41.3	fdce8f852ac7	axios@1.18.0	1.20.0	1
n8nio/runners :2.41.3	1522f8179b76	axios@1.18.0	1.20.0	1
nodered/node-red :5.0.4	10f40d0a83e7	axios@1.19.0	1.20.0	1
nodered/node-red :4.1.10-minimal	d73ae167cb9b	axios@1.16.0	1.20.0	1
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	axios@0.28.1	0.34.0	1
opensearchproject/opensearch-dashboards :2.15.0	b7c26c60bfaf	axios@0.28.0	0.34.0	1
otwld/velero-ui :0.10.3	1c228d9ef71b	axios@1.18.1	1.20.0	1
outlinewiki/outline :1.10.1	832051f039b4	axios@1.18.1	1.20.0	1
rocketadmin/rocketadmin :1.17.7	10955ef540b9	axios@1.15.1	1.20.0	1
supporttools/uptime-kuma :v2.6	f8a49ed65809	axios@0.28.1	0.34.0	1
treskon/portrait-ui :DEV-latest	e7970783bc8d	axios@1.15.2	1.20.0	1
twentycrm/twenty :latest :v2.41.0	47bcefe4e497	axios@1.19.0	1.20.0	1
twentycrm/twenty :v2.43.0	b2b662b1bef1	axios@1.19.0	1.20.0	1
twentycrm/twenty :v2.22.0	e7d9948bf284	axios@1.17.0	1.20.0	1
veecode/devportal	28d1bafed0cf	axios@1.19.0	1.20.0	1
wazuh/wazuh-dashboard :4.11.1	0c58e7b47bb6	axios@0.28.1	0.34.0	1
ghcr.io/cameri/nostream :main	c134ac2fa289	axios@1.18.0	1.20.0	1
ghcr.io/data-fair/notify :3	c739b74dabb0	axios@0.30.0	0.34.0	1
ghcr.io/data-fair/portals :1	8b621866ceb2	axios@0.30.3	0.34.0	1
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	axios@1.18.0	1.20.0	1
ghcr.io/mkutlak/alluredeck-api :0.41.0	fa429df90c68	axios@1.18.1	1.20.0	1
ghcr.io/platform-mesh/portal :v0.27.1	6a7ecd5a0dc2	axios@1.18.0	1.20.0	1
ghcr.io/quenchworks/images/uptime-kuma	78489f7e8402	axios@0.33.0	0.34.0	1
ghcr.io/sredevopsorg/ghost-on-kubernetes :main	06adb21bfdfc	axios@1.18.1	1.20.0	1
ghcr.io/xmv-solutions-gmbh/strapi :latest	a288b4571142	axios@1.16.0	1.20.0	1
mcr.microsoft.com/azure-storage/azurite :latest	830430c1da1a	axios@1.19.0	1.20.0	1
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	axios@1.18.1	1.20.0	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	4f8c0f8a8ee0	axios@1.19.0	1.20.0	1
quay.io/wi_stefan/consent-manager :0.0.6	56399619568b	axios@1.19.0	1.20.0	1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-api-gateway :prod	f8474a665b11	axios@1.19.0	1.20.0	1