CVE-2026-42044 - Vulnerability Analysis

Overview

Axios 1.0.0 to < 1.15.2 contains a prototype pollution vulnerability caused by unvalidated parseReviver in JSON.parse within transformResponse, letting attackers escalate Object.prototype pollution to modify JSON API responses, exploit requires polluted Object.prototype.

Severity & Score

Impact

Attackers can invisibly modify JSON API responses, enabling privilege escalation, balance manipulation, and authorization bypass.

Mitigation

Upgrade to version 1.15.2 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner