Prototype pollution in axios - CVE-2026-42044

Vulnerability identifier: #VU127593

CSH Severity: Medium

CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42044

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to tamper with JSON API responses.

The vulnerability exists due to prototype pollution in parseReviver in lib/defaults/index.js when parsing JSON responses. A remote attacker can pollute Object.prototype.parseReviver via another vulnerable library in the dependency tree to tamper with JSON API responses.

Exploitation requires a separate prototype pollution source in the application's dependency tree.

axios
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
Jira Software Data Center
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images

Install security update from vendor's website.

axios - update to 1.15.2
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.7
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23
• https://github.com/advisories/GHSA-3w6x-2g7m-8v23

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center