CVE-2026-42264
criticalAxios is a promise based HTTP client for the browser and Node.js.
Vendor / product: Axios — axios
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
CVSS
9.1
9.1 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-05-08 04:16
Modified: 2026-09-11 13:17
NVD status: Modified
Last synced 3 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
axios / axios ≥1.0.0 <1.15.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa
Patch / mitigation: https://github.com/axios/axios/pull/10779
Patch / mitigation: https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
Patch / mitigation: https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
References
- https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa security-advisories@github.com
- https://github.com/axios/axios/pull/10779 security-advisories@github.com
- https://github.com/axios/axios/releases/tag/v1.15.2 security-advisories@github.com
- https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj security-advisories@github.com
- https://access.redhat.com/errata/RHSA-2026:20889 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:20938 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:33173 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:36207 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37287 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37288 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:37297 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:41928 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:41951 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:42142 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:50300 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:60520 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:62260 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:66488 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/errata/RHSA-2026:66545 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://access.redhat.com/security/cve/CVE-2026-42264 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://bugzilla.redhat.com/show_bug.cgi?id=2467927 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42264.json 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗