XSRF Token Protection Flaw in Axios HTTP Client Affects Multiple Versions
CVE-2026-42042

5.4MEDIUM

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
24 April 2026

What is CVE-2026-42042?

A vulnerability in Axios, a popular HTTP client library, compromises its XSRF token protection mechanism. This issue arises when the withXSRFToken configuration property accepts a truthy non-boolean value, leading to a bypass of the same-origin policy checks. As a result, XSRF tokens may be inadvertently sent to cross-origin servers, allowing potential attackers to exploit the flaw. Users are encouraged to upgrade to Axios versions 1.15.1 or 0.31.1, where this vulnerability has been addressed.

Affected Version(s)

axios >= 1.0.0, < 1.15.1 < 1.0.0, 1.15.1

axios < 0.31.1 < 0.31.1

References

https://github.com/axios/axios/security/advisories/GHSA-x...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.