# CVE-2026-42264: Axios prototype pollution gadgets in HTTP adapter config

Source: https://junglewise.ai/threats/cve-2026-42264-axios-prototype-pollution-gadgets-in-http-adapter-config  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-42264 · Severity: high · CVSS 7.4 · Published 2026-05-08

Axios, a widely used tool for making web requests in JavaScript applications, contains a vulnerability that could allow attackers to hijack network traffic. If another part of the application is compromised, an attacker can inject malicious settings that Axios will automatically adopt, such as changing where data is sent or bypassing security checks. This could lead to the theft of sensitive login credentials or the redirection of private data to servers controlled by the attacker.

Technologies: [Axios](https://junglewise.ai/threats/technologies/axios), [axios (npm)](https://junglewise.ai/threats/technologies/npm-axios). Vendors: [Axios](https://junglewise.ai/threats/vendors/axios), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-42264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42264 being exploited in the wild.

**How severe is CVE-2026-42264?** High severity, with a CVSS score of 7.4, published 8 May 2026.

**Which products and versions are affected?** Axios 1.0.0 to 1.15.1; axios (npm) SEMVER:introduced=1.0.0,fixed=1.15.2.

**Is there a fix for CVE-2026-42264?** Yes. axios (npm): upgrade to 1.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42264 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42264?** Check whether you run Axios or axios (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- axios (npm): upgrade to 1.15.2 or later

  ```sh
  npm install axios@1.15.2
  ```


## Technical details

Axios versions 1.0.0 through 1.15.1 are vulnerable to prototype pollution gadgets within the Node.js HTTP adapter. The library performs direct property access on configuration objects for properties including 'auth', 'baseURL', 'socketPath', 'beforeRedirect', and 'insecureHTTPParser' without using hasOwnProperty guards. If an attacker successfully pollutes the global Object.prototype via a separate vulnerability in the same process, Axios will inherit these polluted values for every outbound request. This can be exploited to inject unauthorized credentials, redirect requests to malicious base URLs, or enable insecure HTTP parsing. The issue is fixed in version 1.15.2 by implementing null-prototype configuration objects and strict own-property checks.

## Affected products

- Axios Axios 1.0.0 to 1.15.1

## Identifiers

- CVE-2026-42264
- GHSA-q8qp-cvcw-x6jj

## Timeline

- 2026-04-20: patched: Fix committed to v1.x branch
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa](https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa)
- [https://github.com/axios/axios/pull/10779](https://github.com/axios/axios/pull/10779)
- [https://github.com/axios/axios/releases/tag/v1.15.2](https://github.com/axios/axios/releases/tag/v1.15.2)
- [https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj](https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj)
- [https://access.redhat.com/errata/RHSA-2026:33173](https://access.redhat.com/errata/RHSA-2026:33173)
- [https://access.redhat.com/security/cve/CVE-2026-42264](https://access.redhat.com/security/cve/CVE-2026-42264)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2467927](https://bugzilla.redhat.com/show_bug.cgi?id=2467927)

## Related threats

- [Axios NO_PROXY CIDR notation bypass in Node.js adapter](https://junglewise.ai/threats/cve-2026-101899-axios-cidr-form-no-proxy-entries-are-ignored-causing-proxy)
- [Axios prototype pollution in ToFormData](https://junglewise.ai/threats/cve-2026-101909-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter header injection via prototype pollution](https://junglewise.ai/threats/cve-2026-101908-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios fetch adapter maxRedirects bypass](https://junglewise.ai/threats/cve-2026-101907-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)
- [Axios ReDoS in shouldBypassProxy regular expression](https://junglewise.ai/threats/cve-2026-101906-axios-is-a-promise-based-http-client-for-the-browser-and-node-js)