CVE-2026-42035 - Vulnerability Analysis

Overview

Axios < 1.15.1 and < 0.31.1 contains a prototype pollution vulnerability in the HTTP adapter (lib/adapters/http.js) caused by duck-type checking of the data payload, letting attackers inject arbitrary HTTP headers into outgoing requests, exploit requires prior prototype pollution in any dependency.

Severity & Score

Impact

Attackers can inject arbitrary HTTP headers into requests, potentially leading to request forgery or information disclosure.

Mitigation

Update to version 1.15.1 or 0.31.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner