CVE-2026-42033
highAxios is a promise based HTTP client for the browser and Node.js.
Vendor / product: Axios — axios
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.
CVSS
7.4
7.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-04-24 18:16
Modified: 2026-11-11 23:10
NVD status: Modified
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
axios / axios <0.31.1, ≥1.0.0 <1.15.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf
Patch / mitigation: https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf
References
- https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf security-advisories@github.com
- https://access.redhat.com/errata/RHSA-2026:14937 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16476 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16532 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16534 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16535 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16542 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:16874 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:17468 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:17474 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:17657 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:17699 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:19109 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:19375 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:20889 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:20938 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:21017 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:21338 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:21772 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:22465 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:22619 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:22629 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:22840 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:23361 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:24536 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗