Null Byte Interaction Error (Poison Null Byte) in axios - CVE-2026-42040

Vulnerability identifier: #VU127597

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-42040

CWE-ID: CWE-626

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject raw null bytes into serialized URL query parameters.

The vulnerability exists due to null byte interaction error in lib/helpers/AxiosURLSearchParams.js encode() function when serializing parameters through AxiosURLSearchParams.toString() without an encoder or through custom paramsSerializer delegation. A remote attacker can supply crafted input containing null bytes to inject raw null bytes into serialized URL query parameters.

The standard axios request flow using buildURL is not affected, and exploitation is limited to direct AxiosURLSearchParams usage or custom serializer paths that delegate to the internal encoder.

axios
Storage Sentinel Anomaly Scan Engine
IBM supplied MQ Advanced container images
Rational Developer for i
QRadar Threat Intelligence
QRadar Deployment Intelligence App
IBM Cloud Pak System
IBM MQ Operator
IBM Sterling Secure Proxy
IBM Sterling External Authentication Server
IBM Decision Optimization for Cloud Pak for Data

Install security update from vendor's website.

axios - addressed in versions 0.31.1, 1.15.1
Storage Sentinel Anomaly Scan Engine - update to 2.3.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM Sterling Secure Proxy - addressed in versions 6.1.0.4 iFix01, 6.2.1.2.iFix02
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Rational Developer for i - update to 9.9.0.4
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw

• Multiple vulnerabilities in axios
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Rational Developer for i
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM Sterling Secure Proxy
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM QRadar Threat Intelligence