CVE-2026-42041

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42041) has been identified in Axios's configuration merging logic. Axios uses validateStatus to determine whether an HTTP response represents success or failure. However, its merge logic accepts inherited properties, allowing a malicious validateStatus value introduced through a separate prototype pollution flaw to override normal status validation. Responses such as 401, 403, and 500 can consequently resolve as successful requests, potentially bypassing application error handling and authentication checks.

This behavior maps to CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly called prototype pollution. Altered prototype properties can influence components that inherit them, changing application behavior. The advisory also identifies CWE-287 (Improper Authentication), reflecting the potential to undermine authentication decisions when failed requests are treated as successful. Exploitation requires an existing way to pollute the prototype.

Details

Module Info

Product: Axios
Affected packages: axios
Affected versions:

• >=1.0.0, <1.15.1
• <0.31.1

GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm

• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Axios applications exposed to prototype pollution. The advisory's severity panel assigns a CVSS v3.1 score of 4.8. During configuration merging, JavaScript's in operator checks inherited properties, allowing a polluted validateStatus setting to influence response handling.

An attacker who can manipulate Object.prototype could cause HTTP error responses to resolve instead of rejecting. Applications relying on rejection to detect authentication failures may then follow an incorrect success path. This does not itself grant access denied by the remote server.

The associated weaknesses are CWE-1321 (Prototype Pollution) and CWE-287 (Improper Authentication). Together, they describe how manipulated object properties can undermine security decisions when an application fails to reliably establish authentication success. The practical impact depends on how the application interprets and processes the response.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.