CVE-2026-42041
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Published Apr 24, 2026
CVSS 3.1 · 4.8 Medium
EPSS < 1%
KEV · Not listed
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| axios | axios | affected |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Axios | Axios |
|
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-w9j2-pvgh-6h63 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.656% probability within 30 days)
Exploitation poc
Automatable no
Technical Impact partial
References
History
May 6, 2026 12:15 AM
Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-915 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Apr 27, 2026 8:15 PM
First appearance in the feed. Affected versions updated. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Axios
Axios axios |
|
| CPEs | cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* | |
| Vendors & Products |
Axios
Axios axios |
Apr 24, 2026 7:15 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Apr 24, 2026 6:15 PM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1. | |
| Title | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy | |
| Weaknesses | CWE-1321 CWE-287 |
|
| References |
| |
| Metrics |
cvssV3_1
|