Prototype pollution in axios - CVE-2026-42041

Vulnerability identifier: #VU127595

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42041

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass application-level authentication checks and suppress HTTP error handling.

The vulnerability exists due to improperly controlled modification of object prototype attributes ('prototype pollution') in lib/core/mergeConfig.js and lib/core/settle.js when merging request configuration after Object.prototype has been polluted with a crafted validateStatus property. A remote attacker can pollute Object.prototype.validateStatus with a function that always returns true to bypass application-level authentication checks and suppress HTTP error handling.

Exploitation requires chaining with an existing prototype pollution condition elsewhere in the application stack.

axios
Storage Sentinel Anomaly Scan Engine
IBM supplied MQ Advanced container images
Rational Developer for i
IBM Cloud Pak System
IBM MQ Operator
Crowd Data Center
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
Confluence Data Center
Bitbucket Data Center
IBM Decision Optimization for Cloud Pak for Data
JBoss Data Grid

Install security update from vendor's website.

axios - addressed in versions 0.31.1, 1.15.1
Storage Sentinel Anomaly Scan Engine - update to 2.3.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Crowd Data Center - update to 7.2.2
IBM Sterling Secure Proxy - addressed in versions 6.1.0.4 iFix01, 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Bitbucket Data Center - addressed in versions 9.4.21, 10.2.4, 10.3.1
Rational Developer for i - update to 9.9.0.4
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
JBoss Data Grid - update to 8.6.1

• https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
• https://github.com/advisories/GHSA-w9j2-pvgh-6h63

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Confluence Data Center
• Multiple vulnerabilities in IBM Rational Developer for i
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in Crowd Data Center