PT-2026-35050 · Npm · Axios

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-42041

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description The library is susceptible to a Prototype Pollution Gadget attack. This occurs because the validateStatus configuration property utilizes the mergeDirectKeys merge strategy, which employs the JavaScript in operator that traverses the prototype chain. If Object.prototype.validateStatus is polluted with () => true, all HTTP error responses (such as 401, 403, and 500) are treated as successful responses, effectively bypassing application-level authentication and error handling.

Recommendations Update to version 1.15.1 or later. Update to version 0.31.1 or later.

Exploit

Fix

Improper Authentication

Prototype Pollution

Weakness Enumeration

CWE-287

CWE-1321

Related Identifiers

CVE-2026-42041

Affected Products

Axios

References · 3

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://twitter.com/CVEnew/status/2047798590995915088 · Twitter Post