Junglewise Threat Intelligence

CVE-2026-42264: Axios prototype pollution gadgets in HTTP adapter config

CVE-2026-42264 · Severity: high · CVSS 7.4 · Published 2026-05-08

Technologies: Axios. Vendors: Axios.

Executive brief

Axios, a widely used tool for making web requests in JavaScript applications, contains a vulnerability that could allow attackers to hijack network traffic. If another part of the application is compromised, an attacker can inject malicious settings that Axios will automatically adopt, such as changing where data is sent or bypassing security checks. This could lead to the theft of sensitive login credentials or the redirection of private data to servers controlled by the attacker.

Technical details

Axios versions 1.0.0 through 1.15.1 are vulnerable to prototype pollution gadgets within the Node.js HTTP adapter. The library performs direct property access on configuration objects for properties including 'auth', 'baseURL', 'socketPath', 'beforeRedirect', and 'insecureHTTPParser' without using hasOwnProperty guards. If an attacker successfully pollutes the global Object.prototype via a separate vulnerability in the same process, Axios will inherit these polluted values for every outbound request. This can be exploited to inject unauthorized credentials, redirect requests to malicious base URLs, or enable insecure HTTP parsing. The issue is fixed in version 1.15.2 by implementing null-prototype configuration objects and strict own-property checks.

Affected products

  • Axios Axios 1.0.0 to 1.15.1

Timeline

  • 2026-04-20: patched: Fix committed to v1.x branch
  • 2026-05-08: disclosed: CVE published to NVD

References

Related threats