Prototype pollution in axios - CVE-2026-42041

Vulnerability details

The vulnerability allows a remote attacker to bypass application-level authentication checks and suppress HTTP error handling.

The vulnerability exists due to improperly controlled modification of object prototype attributes ('prototype pollution') in lib/core/mergeConfig.js and lib/core/settle.js when merging request configuration after Object.prototype has been polluted with a crafted validateStatus property. A remote attacker can pollute Object.prototype.validateStatus with a function that always returns true to bypass application-level authentication checks and suppress HTTP error handling.

Exploitation requires chaining with an existing prototype pollution condition elsewhere in the application stack.

Affected software

How to mitigate CVE-2026-42041

External References

• https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63
• https://github.com/advisories/GHSA-w9j2-pvgh-6h63

Related Security Bulletins

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Confluence Data Center