Is CVE-2026-42264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42264 being exploited in the wild.

How severe is CVE-2026-42264?

High severity, with a CVSS score of 7.4, published 8 May 2026.

Which products and versions are affected?

Axios 1.0.0 to 1.15.1; axios (npm) SEMVER:introduced=1.0.0,fixed=1.15.2.

Is there a fix for CVE-2026-42264?

Yes. axios (npm): upgrade to 1.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42264 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42264?

Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42264: Axios prototype pollution gadgets in HTTP adapter config

CVE-2026-42264 · Severity: high · CVSS 7.4 · Published 2026-05-08

Axios, a widely used tool for making web requests in JavaScript applications, contains a vulnerability that could allow attackers to hijack network traffic. If another part of the application is compromised, an attacker can inject malicious settings that Axios will automatically adopt, such as changing where data is sent or bypassing security checks. This could lead to the theft of sensitive login credentials or the redirection of private data to servers controlled by the attacker.

Technologies: Axios, axios (npm). Vendors: Axios, npm.

Quick answers

Is CVE-2026-42264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42264 being exploited in the wild.
How severe is CVE-2026-42264?: High severity, with a CVSS score of 7.4, published 8 May 2026.
Which products and versions are affected?: Axios 1.0.0 to 1.15.1; axios (npm) SEMVER:introduced=1.0.0,fixed=1.15.2.
Is there a fix for CVE-2026-42264?: Yes. axios (npm): upgrade to 1.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42264 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42264?: Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

axios (npm): upgrade to 1.15.2 or later
```
npm install axios@1.15.2
```

Technical details

Axios versions 1.0.0 through 1.15.1 are vulnerable to prototype pollution gadgets within the Node.js HTTP adapter. The library performs direct property access on configuration objects for properties including 'auth', 'baseURL', 'socketPath', 'beforeRedirect', and 'insecureHTTPParser' without using hasOwnProperty guards. If an attacker successfully pollutes the global Object.prototype via a separate vulnerability in the same process, Axios will inherit these polluted values for every outbound request. This can be exploited to inject unauthorized credentials, redirect requests to malicious base URLs, or enable insecure HTTP parsing. The issue is fixed in version 1.15.2 by implementing null-prototype configuration objects and strict own-property checks.

Affected products

Axios Axios 1.0.0 to 1.15.1

Identifiers

CVE-2026-42264
GHSA-q8qp-cvcw-x6jj

Timeline

2026-04-20: patched: Fix committed to v1.x branch
2026-05-08: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.