Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-42041

Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Medium4.8Public exploitEPSS 0.66%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 1 day later

    Published

  3. · 5 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-42041, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1Medium4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
redhat-SADPADP (enrichment)3.1High8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
NVDNVD · Modified3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.66% · top 48% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

Affected products

  • axios · axios

    • affected >= 1.0.0, < 1.15.1
    • affected < 0.31.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (41)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-42041 badge
[![CVE-2026-42041](https://trackcve.app/badge/CVE-2026-42041.svg)](https://trackcve.app/cve/CVE-2026-42041)

Record last updated .