DEBIAN-CVE-2026-42264

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2026-42264
Published: 08 May 2026, 04:16
Last modified:15 Jun 2026, 19:06

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
3.1 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

08 May 2026, 04:16
Published
Vulnerability first disclosed
15 Jun 2026, 19:06
Last Modified
Vulnerability information updated

Description

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Systems

  • debian•node-axios

    all | all | all | < 1.15.2-1

References (1)