CVE-2026-42264
HIGHAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
Title source: cnaDescription
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
X_Refsource_Misc x_refsource_misc
https://github.com/axios/axios/pull/10779
X_Refsource_Misc x_refsource_misc
https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa
X_Refsource_Misc x_refsource_misc
https://github.com/axios/axios/releases/tag/v1.15.2
Scores
CVSS v3
7.4
EPSS
0.0007
EPSS Percentile
21.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-1321
Status
published
Products (3)
axios/axios
1.0.0 - 1.15.2
axios/axios
>= 1.0.0, < 1.15.2
npm/axios
1.0.0 - 1.15.2npm
Published
May 08, 2026
Tracked Since
May 08, 2026