PT-2026-35043 · Npm · Axios

Raulvdv · Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42035

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description A prototype pollution gadget exists in the HTTP adapter located in 'lib/adapters/http.js'. This issue occurs due to duck-type checking of the data payload. If Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, the software misidentifies plain object payloads as FormData instances. This allows an attacker to trigger the getHeaders() function and inject arbitrary HTTP headers into outgoing requests. The trigger can be any prototype pollution primitive within the application's dependency tree, not necessarily originating from the software itself.

Recommendations Update to version 1.15.1 or later. Update to version 0.31.1 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-113

CWE-1321

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42035

GHSA-6CHQ-WFR3-2HJ9

Affected Products

Axios

References · 213

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-42035 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25639 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42035 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-42035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34043 · Security Note