CVE-2026-42042: axios Permissive List of Allowed Inputs

Vulnerability summary

CVE-2026-42042 is a medium (CVSS 5.4) Permissive List of Allowed Inputs vulnerability in axios. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-04-2026
   PublishedVulnerability first disclosed.
2. 27-04-2026
   Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.

• CWE-183Permissive List of Allowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
• CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.