Prototype pollution in axios - CVE-2026-42264

Vulnerability identifier: #VU127592

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42264

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject credentials and hijack requests.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the HTTP adapter when reading configuration properties via direct property access from polluted prototypes. A remote attacker can pollute Object.prototype through another dependency in the same process to inject credentials and hijack requests.

Exploitation requires prototype pollution by another dependency in the same process, and requests using relative URLs can be redirected to an attacker-controlled server.

axios
Storage Sentinel Anomaly Scan Engine
Rhapsody Systems Engineering
IBM supplied MQ Advanced container images
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
Confluence Data Center
Jira Software Data Center
IBM DataPower Gateway
Ubuntu
node-axios (Ubuntu package)
JBoss Data Grid

Install security update from vendor's website.

axios - update to 1.15.2
Storage Sentinel Anomaly Scan Engine - update to 2.3.1
Rhapsody Systems Engineering - update to 1.8.0
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - update to 11.3.7
IBM Sterling Secure Proxy - addressed in versions 6.1.0.4 iFix01, 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
IBM DataPower Gateway - addressed in versions 10.5.0.22, 10.6.0.10, 11.0.0.2
node-axios (Ubuntu package) - addressed in versions 0.19.0+dfsg-2ubuntu0.1~esm1, 0.26.0+dfsg-1ubuntu0.1~esm1, 1.6.8+dfsg-2ubuntu0.1~esm1, 1.13.2+dfsg-1ubuntu0.1~esm1
JBoss Data Grid - update to 8.6.2

• https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in Jira Service Management Data Center and Jira Service Management Server
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Cloud Pak System
• IBM DataPower Gateway update for Axios
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in IBM Rhapsody Systems Engineering
• Ubuntu update for node-axios
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in JBoss Data Grid 8.6