Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript's in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () => true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-24 | 1 | Patch1 |
| 2026-04-25 | 1 | Disclosure1 |
CVE-2026-42041 Prototype Pollution Vulnerability in Axios HTTP Client Library Versions Below 1.15.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42041
Post summary
The snippet announces CVE-2026-42041 as a prototype‑pollution flaw affecting Axios HTTP client library versions below 1.15.1, without detailing exploitation or remediation.
CVE-2026-42041 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack… https://www.cve.org/CVERecord?id=CVE-2026-42041
Post summary
The post discloses a prototype‑pollution vulnerability in Axios and recommends upgrading to at least versions 1.15.1 or 0.31.1 to remediate.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |