CVE-2026-42264 — Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Description (CNA)

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

Affected (CNA)

Vendor / product	Versions
axios / axios	affected >= 1.0.0, < 1.15.2

CWE

CWE-1321

References

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj

redhat-SADP

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object prototype, Axios can unknowingly use these manipulated values in its outbound network requests. This could lead to the disclosure of sensitive information or the alteration of network communications, compromising data confidentiality and integrity.