Axios up to 1.15.1 HTTP Request prototype pollution

Summaryinfo

A vulnerability, which was classified as problematic, was found in Axios up to 1.15.1. Affected by this issue is some unknown functionality of the component HTTP Request Handler. Such manipulation leads to prototype pollution. This vulnerability is referenced as CVE-2026-42264. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Axios up to 1.15.1. Affected by this issue is some unknown functionality of the component HTTP Request Handler. The manipulation with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-42264 since 04/26/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.

Upgrading to version 1.15.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1654). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• IBM App Connect Enterprise

Productinfo

Name

• Axios

Version

• 1.15.0
• 1.15.1

Website

• Product: https://github.com/axios/axios/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion