Skip to main content

Axios HTTP Client EUVDEUVD-2026-25606

| CVE-2026-42041 MEDIUM
Improper Authentication (CWE-287)
2026-04-24 GitHub_M GHSA-w9j2-pvgh-6h63
Authentication Bypass Node.js Axios
6.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify prototype pollution source
  2. Delivery
    Pollute Object.prototype.validateStatus
  3. Exploit
    Trigger HTTP request in Axios
  4. Execution
    validateStatus resolves to polluted function
  5. Persist
    Error response accepted as success
  6. Impact
    Authentication bypass achieved

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires two specific conditions: first, a separate prototype pollution vulnerability must exist in the application or one of its dependencies (this CVE is the payload, not the initial vector); second, the vulnerable Axios version must be invoked to make HTTP requests after the prototype pollution occurs. The validateStatus check must be evaluated during response handling - by default Axios invokes this check unless explicitly disabled. The attack does not require user interaction, authentication to the target application, or specialized network position, but it does require the attacker to first establish prototype pollution in the JavaScript execution context. Applications that explicitly set validateStatus to a custom function (not relying on the default) may reduce exposure but are not fully protected if that function is not called due to the pollution.
Impact

CVSS 4.8 reflects network attack vector but high complexity (AC:H), indicating prototype pollution attacks are not trivial to execute in isolation. The EPSS score is not provided, limiting exploitation probability quantification. No CISA KEV status or public POC referenced, suggesting no confirmed active exploitation at time of analysis. Real-world risk is moderate but context-dependent: if an application has a separate prototype pollution source, this becomes a high-impact escalation vector that silently bypasses security controls. The vulnerability is particularly dangerous because it is silent - applications will not log or alert on suppressed authentication failures, making detection difficult. However, exploitation requires a two-step attack (initial pollution + subsequent HTTP request to a vulnerable Axios instance), increasing the barrier compared to direct remote code execution.
Exploit ScenarioDerived

An attacker exploits a separate prototype pollution vulnerability in the target application (e.g., via unsafe JSON parsing or object merge) to set Object.prototype.validateStatus to a function returning true. Subsequently, when the application makes an HTTP request using vulnerable Axios to an API that returns a 401 Unauthorized or 403 Forbidden response, Axios evaluates validateStatus without finding the property on the response config object itself, then checks the prototype chain via the in operator, finds the polluted function, executes it, and treats the error response as success. The application's authentication check is silently bypassed.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 24, 2026

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error responses via pollution of Object.prototype.validateStatus, causing authentication failures and server errors to be silently treated as successful responses. The vulnerability requires high attack complexity (prototype pollution gadget chain) but enables complete bypass of application-level authentication and error handling without user interaction.

RemediationAI

Upgrade Axios to version 1.15.1 or later (for 1.x series) or version 0.31.1 or later (for 0.x series). This fix modifies the validateStatus merge strategy to avoid prototype chain traversal. For applications unable to immediately upgrade, implement input validation to prevent prototype pollution in the first place - sanitize or validate all untrusted data before it is used in object property assignments or JSON parsing. Additionally, configure Content Security Policy and disable eval/Function constructors where possible to limit gadget chain availability. Patch application code to explicitly check HTTP status codes independently rather than relying solely on Axios validateStatus configuration. Reference: https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63

Affected VersionsENISA

axios 1.0.0, < 1.15.1
axios < 0.31.1

Affected Packages

npm axios fix: 0.31.1, 1.15.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is a promise-based HTTP client for JavaScript environments (browser and Node.js). The vulnerability stems from the validateStatus configuration property, which is the only Axios config property using a mergeDirectKeys merge strategy that relies on JavaScript's in operator. The in operator inherits properties from the prototype chain; when Object.prototype.validateStatus is polluted with a function returning true, the validateStatus check accepts all HTTP status codes as successful. CWE-287 (Improper Authentication) applies because the pollution mechanism bypasses the authentication error handling mechanism that relies on validateStatus evaluation. The attack is a second-order exploit: the prototype pollution must occur first (via another gadget or separate vulnerability), then Axios encounters the polluted prototype during HTTP response validation.

Know when Axios gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE 4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat 8.2 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
CVSS changed
Jun 30, 2026 - 03:24 NVD
4.8 (MEDIUM) 6.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:07 nvd
Patch available
Patch available
Apr 24, 2026 - 20:17 EUVD
CVE Published
Apr 24, 2026 - 17:55 nvd
MEDIUM 4.8

DescriptionNVD

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator - an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

52
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Axios

View all
CVE-2026-42043 CRITICAL POC
10.0 Apr 24

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a requ
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42039 MEDIUM POC
6.9 Apr 24

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
CVE-2023-45857 MEDIUM POC
6.5 Nov 08

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:14937 ADVISORY https://access.redhat.com/errata/RHSA-2026:16476 ADVISORY https://access.redhat.com/errata/RHSA-2026:16532 ADVISORY https://access.redhat.com/errata/RHSA-2026:16534 ADVISORY https://access.redhat.com/errata/RHSA-2026:16535 ADVISORY https://access.redhat.com/errata/RHSA-2026:16542 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42041 ADVISORY https://vuldb.com/vuln/359501 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-42041 REF https://access.redhat.com/errata/RHSA-2026:16874 REF https://access.redhat.com/errata/RHSA-2026:17468 REF https://access.redhat.com/errata/RHSA-2026:17474 REF https://access.redhat.com/errata/RHSA-2026:17657 REF https://access.redhat.com/errata/RHSA-2026:17699 REF https://access.redhat.com/errata/RHSA-2026:19109 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:21017 REF https://access.redhat.com/errata/RHSA-2026:21338 REF https://access.redhat.com/errata/RHSA-2026:21772 REF https://access.redhat.com/errata/RHSA-2026:22465 REF https://access.redhat.com/errata/RHSA-2026:22619 REF https://access.redhat.com/errata/RHSA-2026:22629 REF https://access.redhat.com/errata/RHSA-2026:22840 REF https://access.redhat.com/errata/RHSA-2026:23361 REF https://access.redhat.com/errata/RHSA-2026:24536 REF https://access.redhat.com/errata/RHSA-2026:24539 REF https://access.redhat.com/errata/RHSA-2026:24853 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:25041 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:25271 REF https://access.redhat.com/errata/RHSA-2026:25273 REF https://access.redhat.com/errata/RHSA-2026:26214 REF https://access.redhat.com/errata/RHSA-2026:26225 REF https://access.redhat.com/errata/RHSA-2026:26232 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/security/cve/CVE-2026-42041 REF https://bugzilla.redhat.com/show_bug.cgi?id=2461629 REF https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42041.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy