Prototype pollution in axios - CVE-2026-42264

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127592

Prototype pollution in axios - CVE-2026-42264

Published: April 24, 2026


Vulnerability identifier: #VU127592
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42264
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject credentials and hijack requests.

The vulnerability exists due to improperly controlled modification of object prototype attributes in the HTTP adapter when reading configuration properties via direct property access from polluted prototypes. A remote attacker can pollute Object.prototype through another dependency in the same process to inject credentials and hijack requests.

Exploitation requires prototype pollution by another dependency in the same process, and requests using relative URLs can be redirected to an attacker-controlled server.


Affected software

axios
Rhapsody Systems Engineering
IBM supplied MQ Advanced container images
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
IBM DataPower Gateway

How to mitigate CVE-2026-42264

Install security update from vendor's website.

axios - update to 1.15.2
Rhapsody Systems Engineering - update to 1.8.0
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - update to 11.3.7
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
IBM DataPower Gateway - addressed in versions 10.5.0.22, 10.6.0.10, 11.0.0.2

External References

Related Security Bulletins