PT-2026-36988 · Npm · Axios

Bulmax9797-Sketch · Published 2026-05-05 · Updated 2026-05-18 · CVE-2026-42264

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.15.1

Description Axios is a promise-based HTTP client for the browser and Node.js. The HTTP adapter reads five configuration properties—auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser—via direct property access without using hasOwnProperty guards. This allows these properties to act as prototype pollution gadgets. If Object.prototype is polluted by another dependency within the same process, Axios will silently use these polluted values for every outbound HTTP request. Prototype pollution is a vulnerability where an attacker can manipulate the prototype of a base object, leading to the injection of properties into all objects inheriting from that prototype.

Recommendations Update to version 1.15.2.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42264

Affected Products

Axios

References · 218

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj · Exploit
• https://github.com/axios/axios/pull/10779 · Patch
• https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42039 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42037 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42338 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-29085 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42264 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-BE61221 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-42264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39409 · Security Note