Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-42041Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Medium 4.8

In plain English

A medium-severity improper authentication in axios from axios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-axiosno fix listedDEBIAN-CVE-2026-42041
Debian:13node-axiosno fix listedDEBIAN-CVE-2026-42041
Debian:14node-axios1.15.2-1DEBIAN-CVE-2026-42041
Ubuntu:25.10node-axiosno fix listedUBUNTU-CVE-2026-42041
Ubuntu:26.10node-axiosno fix listedUBUNTU-CVE-2026-42041
npmaxios0.31.1GHSA-w9j2-pvgh-6h63
npmaxios1.15.1GHSA-w9j2-pvgh-6h63

Affected products (as reported)

VendorProductVersions
axios axios >= 1.0.0, < 1.15.1< 0.31.1

Weakness: CWE-287, CWE-1321, CWE-915 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References