PT-2026-35042 · Npm · Axios

Dolevmiz1

·

Published

2026-04-24

·

Updated

2026-05-18

·

CVE-2026-42033

CVSS v3.1

7.4

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.1 Axios versions prior to 1.15.1
Description An issue exists where the software reads keys from Object.prototype without a hasOwnProperty guard. If a co-dependency pollutes the Object.prototype, an attacker can silently intercept and modify every JSON response before the application processes it, or fully hijack the underlying HTTP transport to gain access to request credentials, headers, and the body. This requires prototype pollution from a separate source within the same process.
Recommendations Update to version 0.31.1 Update to version 1.15.1

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CLEANSTART-2026-BE61221
CLEANSTART-2026-LC05413
CVE-2026-42033
GHSA-PF86-5X62-JRWF

Affected Products

Axios