Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-42033Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

High 7.4

In plain English

A high-severity prototype pollution in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.9%top 41.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-axiosno fix listedDEBIAN-CVE-2026-42033
Debian:13node-axiosno fix listedDEBIAN-CVE-2026-42033
Debian:14node-axios1.15.2-1DEBIAN-CVE-2026-42033
Ubuntu:25.10node-axiosno fix listedUBUNTU-CVE-2026-42033
Ubuntu:26.10node-axiosno fix listedUBUNTU-CVE-2026-42033
npmaxios0.31.1GHSA-pf86-5x62-jrwf
npmaxios1.15.1GHSA-pf86-5x62-jrwf

Affected products (as reported)

VendorProductVersions
axios axios >= 1.0.0, < 1.15.1< 0.31.1

Weakness: CWE-1321, CWE-915 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References