9.1

CVE-2026-42264: Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

Modified
AliasesUBUNTU-CVE-2026-42264DEBIAN-CVE-2026-42264CGA-26m8-8wqw-4hmf
Published 08-05-2026Last modified 11-09-2026

Vulnerability summary

CVE-2026-42264 is a critical (CVSS 9.1) vulnerability in axios. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
9.1/10
010
Critical · v3.1 (NVD)
EPSS score
0.80%
0%100%
Low · -0.17 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 3
OPENSUSE-SU-2026:20919-1CGA-W76Q-3R52-37RXUSN-8638-1

Timeline

  1. 08-05-2026
    PublishedVulnerability first disclosed.
  2. 11-09-2026
    Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

Decrease -0.17 pp

From 0.97% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard79 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • awx< 24.6.1-r42
  • gitlab-rails-ce-18.1< 18.1.6-r32
  • gitlab-rails-ce-18.10All versions (No fix recorded) | < 18.10.8-r8
Wolfi19 products
  • jitsucom-jitsu-console< 2.11.0-r22
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
Axios1 product
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.15.2-1
Npm1 product
  • axios≥ 1.0.0, < 1.15.2
Ubuntu1 product
  • node-axios< 1.6.8+dfsg-2ubuntu0.1~esm1 | All versions (No fix recorded) | < 1.13.2+dfsg-1ubuntu0.1~esm1

6 vendors · 102 products

References

29 links
Show all 29 references