Prototype Pollution Vulnerability in Axios HTTP Client

CVE-2026-42044

What is CVE-2026-42044?

The Axios library, commonly used for handling HTTP requests in both browser and Node.js environments, is susceptible to a Prototype Pollution attack. This vulnerability allows an attacker to exploit Object.prototype pollution within the application's dependency structure, leading to critical modifications of all JSON API responses. Such manipulations can result in privilege escalation, balance changes, and bypassing authorization checks. The issue arises due to the lack of validation in the default transformResponse function involving JSON parsing. This vulnerability has been addressed and resolved in Axios version 1.15.2.

References