Critical severity · published May 8, 2026
CVE-2026-42264
Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking
9.1
CVSS
0.8%
EPSS
No
On KEV
Description
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AX
axios · axios
>= 1.0.0, < 1.15.2 · source: vendor, NVD
OP
OpenShift Pipelines · Red Hat
All versions, or not specified · source: CISA
OS
OpenShift Service Mesh 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat 3scale API Management Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Security 4.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Migration Toolkit 1.8 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42264
Patch
https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa
Issue Tracking
https://github.com/axios/axios/pull/10779
Product
https://github.com/axios/axios/releases/tag/v1.15.2
Exploit
https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20889
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:20938
More from axios
10.0
CVE-2026-42043
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.8
CVE-2024-57965
In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call
9.1
CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
8.7
CVE-2026-44494
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`