Null Byte Interaction Error (Poison Null Byte) in axios - CVE-2026-42040
Published: April 24, 2026
Vulnerability identifier: #VU127597
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42040
CWE-ID: CWE-626
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject raw null bytes into serialized URL query parameters.
The vulnerability exists due to null byte interaction error in lib/helpers/AxiosURLSearchParams.js encode() function when serializing parameters through AxiosURLSearchParams.toString() without an encoder or through custom paramsSerializer delegation. A remote attacker can supply crafted input containing null bytes to inject raw null bytes into serialized URL query parameters.
The standard axios request flow using buildURL is not affected, and exploitation is limited to direct AxiosURLSearchParams usage or custom serializer paths that delegate to the internal encoder.
Affected software
axios
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
IBM Cloud Pak System
IBM MQ Operator
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
How to mitigate CVE-2026-42040
Install security update from vendor's website.
axios - addressed in versions 0.31.1, 1.15.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6