Axios up to 1.15.1 lib/defaults/index.js dynamically-determined object attributes

Summaryinfo

A vulnerability labeled as problematic has been found in Axios up to 1.15.1. This vulnerability affects unknown code in the library lib/defaults/index.js. Such manipulation leads to dynamically-determined object attributes. This vulnerability is documented as CVE-2026-42044. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Axios up to 1.15.1. Affected by this issue is an unknown part in the library lib/defaults/index.js. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. Using CWE to declare the problem leads to CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses — including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, this.parseReviver), where this is the merged config object. Because parseReviver is not present in Axios defaults, not validated by assertOptions, and not subject to any constraints, a polluted Object.prototype.parseReviver function is called for every key-value pair in every JSON response, allowing the attacker to selectively modify individual values while leaving the rest of the response intact. This vulnerability is fixed in 1.15.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-42044 since 04/23/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.15.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Axios

Version

• 1.15.0
• 1.15.1

Website

• Product: https://github.com/axios/axios/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion