PT-2026-35050 · Npm · Axios

August829 · Published 2026-04-24 · Updated 2026-06-08 · CVE-2026-42041

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Axios versions prior to 1.15.1 Axios versions prior to 0.31.1

Description The library is susceptible to a Prototype Pollution Gadget attack. This occurs because the validateStatus configuration property utilizes the mergeDirectKeys merge strategy, which employs the JavaScript in operator that traverses the prototype chain. If Object.prototype.validateStatus is polluted with () => true, all HTTP error responses (such as 401, 403, and 500) are treated as successful responses, effectively bypassing application-level authentication and error handling.

Recommendations Update to version 1.15.1 or later. Update to version 0.31.1 or later.

Exploit

Fix

Prototype Pollution

Improper Authentication

Weakness Enumeration

CWE-1321

CWE-287

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42041

GHSA-W9J2-PVGH-6H63

OPENSUSE-SU-2026:20919-1

Affected Products

Axios

References · 220

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:20919-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-69873 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-42041 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-LC05413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44458 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39409 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29085 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44456 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27903 · Security Note