CVE-2026-42033 - Vulnerability Analysis

Overview

Axios < 1.15.1 and < 0.31.1 contains a prototype pollution vulnerability caused by lack of hasOwnProperty guard when reading Object.prototype keys, letting attackers intercept/modify JSON responses or hijack HTTP transport, exploit requires prior prototype pollution.

Severity & Score

Impact

Attackers can intercept/modify JSON responses or hijack HTTP transport, accessing request credentials, headers, and body.

Mitigation

Update to version 1.15.1 or 0.31.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner