Axios HTTP Client CVE-2026-42040

The vulnerability requires that an attacker can influence input passed to the AxiosURLSearchParams.encode() function directly. Standard axios request usage (get(), post(), etc.) does not trigger this code path, so applications using axios in the typical documented manner are unaffected. Exploitation is limited to scenarios where application code explicitly calls encode() on untrusted input and the resulting null bytes are processed by downstream systems in a security-relevant manner. The encoding function must be invoked outside the standard request flow, making this a non-default exploitation condition. Additionally, the downstream system must treat null bytes (%00 reversed to \x00) differently than the safe percent-encoded form to produce security impact.

This vulnerability presents low real-world risk despite network-accessible attack vector. CVSS score of 3.7 with AC:H (high complexity) and limited impact (integrity only, no confidentiality or availability effects) reflects the constraints. The high complexity requirement suggests attackers must craft specific conditions to exploit this flaw, and the description explicitly states the standard axios request flow is unaffected, meaning typical usage is protected. EPSS data is unavailable for independent exploitation probability assessment, and no CISA KEV listing or public proof-of-concept code has been identified. The vulnerability only manifests in non-standard code paths or edge-case integrations where the encode() function is called directly rather than through standard request methods. The integrity impact is further limited because the resulting null bytes would need to be processed by a downstream system that both accepts null bytes and treats them differently than percent-encoded equivalents-a scenario requiring specific application logic beyond axios itself.

An attacker would need to identify code within or integrated with an axios implementation that directly calls the AxiosURLSearchParams.encode() function on attacker-controlled input, rather than using standard axios request methods. For example, if an application manually invokes encode() on user-supplied data and passes the result to a downstream system that processes null bytes differently than percent-encoded sequences, the attacker could inject null bytes to alter the application's behavior. This scenario requires both non-standard axios usage and specific downstream processing logic, making exploitation highly dependent on application implementation details.