CVE-2026-42035
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.40%
- CWE
- CWE-113, CWE-1321
- Published
- 2026-04-24
- Last modified
- 2026-04-25
Affected products
- axios axios
- axios axios
Weakness type
Related vulnerabilities
- CVE-2026-77341 — cpp-httplib: CRLF injection via unvalidated HTTP trailer headers in chunked response writing
- CVE-2026-39915 — TIM Flow < 26.0.6 CRLF Injection via rt Parameter
- CVE-2026-50576 — ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests
- CVE-2026-67289 — FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
- CVE-2026-66746 — Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
- CVE-2026-66753 — tiny-http 0.12.0 HTTP Response Splitting via Header Injection
- CVE-2026-63771 — Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
- CVE-2026-54163 — secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input