CVE-2026-42042

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42042) has been identified in Axios’s browser-side XSRF token handling. Axios accepts truthy non-boolean values for withXSRFToken, including the string "false", as permission to send the token cross-origin. If introduced through prototype pollution or misconfiguration, these values bypass the same-origin check, potentially exposing the token to an attacker-controlled destination.

This unintended token disclosure maps to CWE-201 (Insertion of Sensitive Information Into Sent Data), where outgoing data contains information the recipient should not receive. The advisory also identifies CWE-183 (Permissive List of Allowed Inputs), reflecting Axios’s acceptance of unintended configuration values. Together, these weaknesses can cause an anti-CSRF token to cross its intended trust boundary.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions:
  • >=1.0.0, <1.15.1
  • <0.31.1
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects Axios applications in standard browser environments. A truthy non-boolean withXSRFToken value short-circuits the same-origin check, allowing a readable XSRF cookie value to be attached to cross-origin requests. The advisory assigns a CVSS v3.1 score of 5.4.

Exploitation requires the affected setting, an available token, and a request to an attacker-controlled destination. Prototype pollution through another component can introduce the setting, while misconfiguration can trigger the same behavior. A leaked token may facilitate CSRF, but does not itself establish an authenticated session.

This behavior aligns with CWE-201 and CWE-183. Sensitive information should be transmitted only to authorized recipients, with configuration values interpreted precisely enough to preserve that restriction. Here, permissive value handling can undermine token confidentiality and weaken the application’s CSRF defenses.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.