Prototype Pollution in Axios HTTP Client Affecting Multiple Versions
CVE-2026-42033
What is CVE-2026-42033?
The Axios HTTP client, widely used for handling HTTP requests in both browser and Node.js environments, has a vulnerability resulting from inadequate safeguards against prototype pollution. Attackers can exploit this flaw, allowing them to intercept and alter JSON responses seamlessly before these responses are processed by the application. Moreover, the risk extends to the complete hijacking of the HTTP transport, giving attackers potential access to sensitive request credentials, headers, and body information. This vulnerability arises specifically from a situation where the Object.prototype has been compromised by a co-dependency that manipulates keys. The issue has been addressed in versions 1.15.1 and 0.31.1.
Affected Version(s)
axios >= 1.0.0, < 1.15.1 < 1.0.0, 1.15.1
axios < 0.31.1 < 0.31.1