Vulnerability Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Axios | Axios | < 0.31.1 |
Related Weaknesses (CWE)
References
- https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9ExploitMitigationVendor Advisory
- https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-42035?
CVE-2026-42035 is a vulnerability with a CVSS score of 7.4 (HIGH). Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attack...
How severe is CVE-2026-42035?
CVE-2026-42035 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42035?
Check the references section above for vendor advisories and patch information. Affected products include: Axios Axios.