CVE-2026-42041 - Vulnerability Analysis

Overview

Axios < 1.15.1 and < 0.31.1 contains a prototype pollution vulnerability caused by improper merge strategy in validateStatus config, letting attackers bypass HTTP error handling and authentication by polluting Object.prototype, exploit requires prototype pollution capability.

Severity & Score

Impact

Attackers can bypass application-level authentication and error handling, treating all HTTP errors as successful responses.

Mitigation

Update to versions 1.15.1 or 0.31.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner