Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin servers controlled by an attacker. This vulnerability is fixed in 1.15.1 and 0.31.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42042 XSRF Token Protection Bypass in Axios via Truthy Semantics Logic Error https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42042
Post summary
Brief disclosure of CVE-2026-42042, describing an XSRF token protection bypass in Axios, with a link to further details.
CVE-2026-42042 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/f… https://www.cve.org/CVERecord?id=CVE-2026-42042
Post summary
CVE-2026-42042 highlights a logic flaw in Axios’ XSRF token protection prior to certain releases, potentially enabling CSRF attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |