CVE-2026-42033

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42033) has been identified in Axios’s handling of inherited configuration properties. When another component has already polluted Object.prototype, Axios can consume attacker-controlled values without checking whether they belong to the configuration object itself. Malicious inherited settings can alter JSON response processing or replace the Node.js HTTP transport, potentially exposing credentials and modifying requests or responses.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. Modified prototype properties can influence objects that inherit them, changing application behavior. In Axios, the vulnerability provides ways to exploit an already polluted prototype; a separate flaw must first introduce the malicious properties. The resulting impact can include sensitive data exposure and request or response tampering.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.15.1; <0.31.1
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • NES for Axios 0.24.2
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1

Vulnerability Info

This high-severity vulnerability affects Axios applications running in an environment where another component has polluted Object.prototype. Missing own-property checks allow inherited configuration values to influence request handling. The Axios advisory assigns a CVSS v3.1 score of 7.4.

An inherited parseReviver function can inspect and modify parsed JSON responses. Separately, an inherited transport object can replace the Node.js HTTP transport, exposing request credentials, headers, and bodies. These attack paths require prototype pollution capable of supplying the necessary callable values.

This behavior aligns with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). Shared prototype modifications can affect downstream components that trust inherited properties. Here, that trust can compromise the confidentiality of exchanged data and the integrity of information processed by the application.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.