Prototype Pollution Vulnerability in Axios HTTP Client by Axios

CVE-2026-42264

What is CVE-2026-42264?

The Axios HTTP client, widely used for browser and Node.js applications, is susceptible to a prototype pollution vulnerability. This issue arises from the improper handling of certain configuration properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) within the HTTP adapter. Without adequate checks like hasOwnProperty, these parameters can be exploited, leading to the inclusion of compromised properties when making outbound HTTP requests. This silent acceptance of polluted values poses significant security risks. The vulnerability affects versions from 1.0.0 up to, but not including, 1.15.2, which has since been patched to close this security gap.

References