CVE-2026-42035: Axios vulnerability (CVSS 7.4)

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityHigh

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Axios≥ 1.0.0 < 1.15.1 · < 0.31.1

Remediation

Fixed in

Axios≥ 1.15.1

Patch & vendor advisories

https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9

References

https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9ExploitMitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-42035 being actively exploited?

CVE-2026-42035 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.38%.

How severe is CVE-2026-42035?

CVE-2026-42035 has a CVSS 3.1 base score of 7.4, rated high. EPSS estimates a 0.38% probability of exploitation.

Which products are affected by CVE-2026-42035?

Affected products include Axios.

How do I fix CVE-2026-42035?

Upgrade affected software to a fixed version, for example Axios 1.15.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-42035 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo